Hermes Agent capabilities

Use this index to select the Hermes operation that owns your task and read its AIP policy contract before invocation. Every configured endpoint publishes the same 35 operations under cap:hermes_agent:<endpoint_id>:<operation>.

The endpoint segment is an admitted routing identity. It is not an input field, display label, or caller-selected URL.

Catalogue identity

A different connector artifact, Hermes revision, or endpoint set requires a new manifest review. A matching operation suffix alone does not prove that a tenant can discover or invoke the capability.

Choose a family

Key counts operations that require an AIP idempotency key. Stream counts four direct SSE operations plus the governed operator lifecycle.

Read a capability ID

For endpoint primary, a model-list capability has this shape:

cap:hermes_agent:primary:models
│                  │       └─ fixed operation
│                  └───────── normalized endpoint ID
└──────────────────────────── connector namespace

Endpoint IDs are trimmed, restricted to ASCII letters, digits, hyphens, and underscores, and normalized to lowercase before manifest construction.

Every capability has one aip.connector.hermes_agent.v1 binding. Its metadata contains the system, endpoint ID, operation, configured base URL, provider method, fixed path template, and streaming marker. Treat that metadata as deployment information, not authority to call the provider directly.

Operation catalogue

Legend: Req means required, Opt means optional, and — means not applicable. Stream describes the advertised AIP execution contract.

The catalogue contains 14 GET, 16 POST, 2 PATCH, and 3 DELETE operations. Sessions and jobs are executable Tool capabilities; they are not entries in the native AIP resource-read API.

Authentication legend

health is the only operation without an endpoint-auth requirement. The other 34 capability records declare Bearer auth sourced from endpoint.api_key.

The standalone host adds that key after endpoint and tenant selection. The AIP caller supplies its own gateway credential and never receives the endpoint key. The capability contract’s credentials field is null because the provider token is startup-loaded rather than selected by each action.

Host route credential revision checks remain a separate authorization layer.

Kind and risk legend

Risk is policy input, not authorization. A medium operation can require an idempotency key without requiring human approval, as run_start and several session operations do.

Approval legend

Approval is required for exactly 11 operations:

• response_delete;
• run_approval and run_stop;
• operator;
• session_delete;
• job_create, job_update, job_delete, job_pause, job_resume, and job_run.

Each published approval policy uses the tenant-policy selector, a 900000 ms validity window, and requires a reason, input snapshot, and policy decision. It grants no delegated authority by itself.

The direct operator capability always requires approval. First-class delegation can add its own connector-level approval gate; an exemption from that gate does not remove the capability’s native approval contract.

Idempotency and retry legend

Fifteen operations require a capability-scoped idempotency key:

• response_delete;
• run_start, run_approval, run_stop, and operator;
• session_create, session_patch, session_delete, and session_fork;
• every job mutation: create, update, delete, pause, resume, and run.

The published key TTL is 86400000 ms. A collision returns the original result. Reuse a key only for the same canonical action contract; a returned original result is not proof that different input was accepted.

The 14 read-only operations advertise retry support and safe retry semantics. All 21 non-reads advertise no connector retry support and unsafe retry semantics, including chat operations whose idempotency key is optional. Preserve the original action ID and reconcile an uncertain provider outcome before any repeat.

Execution and SLA legend

Every operation supports synchronous invocation. Five also advertise async support:

• chat_stream and responses_stream;
• run_start and run_events;
• operator.

The four direct streams, plus operator, advertise streaming and cancellation. session_chat_stream is streaming and cancellable but does not advertise async support. Only run_start, run_events, and operator set the separate SLA async_expected marker.

All operations publish a 10000 ms maximum queue-delay hint and a 99.9% availability target. These are declared contract values, not observed qualification or a deployment guarantee.

Transaction and compensation legend

No Hermes capability publishes an AIP transaction contract. Required idempotency on state-changing operations does not add dry_run, plan, commit, or reconcile modes.

Every operation declares rollback_not_supported and names no compensating capability or window. Approval may be required for the original action, but no automatic inverse is promised.

Side-effect and data legend

Every operation declares external network access and read access. Additional markers are:

The marker set describes possible effect classes. It does not prove that a model replied, a scheduled job delivered output, or an operator tool executed.

All 21 non-read operations declare PII. Redaction is required for 29 operations: every capability except health, health_detailed, models, capabilities, skills, and toolsets.

These are minimum handling labels. Provider input or output may require a stricter tenant classification.

Stability legend

skills, toolsets, response_get, and response_delete are experimental. The other 31 operations are stable at the pinned connector revision.

Stable does not mean qualified against every Hermes build or model provider. Experimental operations require an explicit compatibility and rollout review.

Choose the next page

• Use health-models-and-discovery.md for the six non-mutating discovery contracts.
• Use chat-and-responses.md for OpenAI-compatible chat, Responses API, and stored-response operations.
• Use durable-runs-and-approvals.md for structured run start, observation, approval, and stop.
• Use operator-and-delegation.md for governed operator and first-class AIP delegation.
• Use sessions.md for persisted conversations.
• Use scheduled-jobs.md for durable job definitions and controls.

Related documentation

• Hermes Agent connector
• Hermes configuration
• Capabilities and contracts
• Approvals and policy
• Transactions and compensation