Add feature flag management via the public Split.io Admin API

[VArsenyan]

Summary

• The existing fme.spec.yaml targets Harness's own /v3/feature-flags API, which is unreleased (harness_internal: true). This adds a new splitio module that talks directly to api.split.io — the real, currently-public FME backend.
• New nouns: fme_workspace, fme_environment, fme_traffic_type, fme_rollout_status, fme_flag — list/get/create/update/delete on fme_flag, plus execute fme_flag:kill|restore|archive|unarchive.
• Since that API lives on a different host with different auth than the Harness gateway, three small generic capabilities were added:
  • endpoint.path may now be an absolute URL; when it is, buildRequest skips the accountIdentifier query param and the default Harness auth header, and the spec supplies its own auth via request_headers.
  • a new env() expr-lang function lets request_headers/body_params pull a secret from an environment variable instead of hardcoding it in spec YAML.
  • a new authToken() expr-lang function returns the active profile's bearer credential (the key from harness login).

Auth: reuses your existing key (no second key required)

splitio reuses the active profile's credential as the Split.io Bearer token, so a normal harness login is all that's needed — no separate key to set up. This matches the official Harness MCP server. The auth header is simply:

request_headers:
  Authorization: '"Bearer " + authToken()'

• AGENTS.md updated with an "External (non-gateway) APIs" section (documenting authToken() vs env()) and a splitio.spec.yaml row in the spec file table.

Test plan

• go build ./... and go test ./... pass repo-wide
• TestAuthTokenHeader covers PAT and SSO profile tokens
• harness get module splitio renders help text correctly
• harness list fme_flag --help / harness update fme_flag --help show expected flags and usage
• Confirmed no noun/alias collisions with existing specs (workspace/environment are already claimed by iacm/cd, hence the fme_ prefix)
• End-to-end against live api.split.io with the profile token only: list fme_workspace, list fme_flag <ws> --tag <t>, and get fme_flag <ws>/<name> all return real data

Screenshots

Auth — reuses profile credential, no separate key

List workspaces

List flags filtered by team tag (created dates formatted)

Get flag — tags rendered as names, formatted date

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

varsenyan seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[VArsenyan]

@sawka-harness Hi! Just a friendly ping on this PR. This change is needed for an internal tool I’m working on at Adobe.

When you get a chance, could you please take a look and review it? I’d really appreciate it. Thanks!

[sawka-harness]

@VArsenyan thanks for your submission! Are you able to sign the CLA (we'll need that to merge your PR)? In the mean time I'll have someone from the FME team look over the PR as well.

[VArsenyan]

@VArsenyan thanks for your submission! Are you able to sign the CLA (we'll need that to merge your PR)? In the mean time I'll have someone from the FME team look over the PR as well.

Thanks for the response! I’ve signed the CLA multiple times, but it seems like something isn’t working correctly. Even after clicking “Recheck,” the status here doesn’t update.

Is this a known issue with the CLA signing tool, or is there anything else I need to do on my end?