> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seaotter.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exec hermes CLI

> Run an allowlisted `hermes <argv…>` command inside the agent pod as an argv array (never a shell string). Tier-3 destructive commands require `confirm=true`. `--yolo` is never accepted. Every invocation is audit-logged.



## OpenAPI

````yaml /openapi.json post /api/v1/agents/{agent_id}/exec
openapi: 3.1.0
info:
  title: SEAOTTER API
  description: >-
    SEAOTTER control plane API — managed Hermes Agent hosting. Authenticate with
    a Clerk session JWT (web) or an org-scoped API key (`Authorization: Bearer
    so_…` from POST /api/v1/api-keys). Public developer docs:
    https://docs.seaotter.dev
  version: 1.0.0
servers:
  - url: https://api.seaotter.dev
    description: Production
  - url: https://seaotter-api-bpenevambq-uc.a.run.app
    description: Production (Cloud Run URL)
  - url: http://localhost:8000
    description: Local development
security: []
tags:
  - name: agents
    description: Provision and operate Hermes agents
  - name: billing
    description: Stripe plans and subscriptions
  - name: users
    description: Current user and control-plane API keys
  - name: organizations
    description: Active organization context
  - name: audit
    description: Organization audit log (Enterprise)
  - name: health
    description: Liveness probes
paths:
  /api/v1/agents/{agent_id}/exec:
    post:
      tags:
        - agents
      summary: Exec hermes CLI
      description: >-
        Run an allowlisted `hermes <argv…>` command inside the agent pod as an
        argv array (never a shell string). Tier-3 destructive commands require
        `confirm=true`. `--yolo` is never accepted. Every invocation is
        audit-logged.
      operationId: exec_hermes_command_api_v1_agents__agent_id__exec_post
      parameters:
        - name: agent_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Agent Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentExecIn'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentExecOut'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '401':
          description: Missing or invalid Bearer token (Clerk JWT or so_ API key)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '402':
          description: Plan capacity or billing required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '403':
          description: Authenticated but not permitted (role or plan gate)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '409':
          description: Conflict with current agent state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '503':
          description: Transient failure — Cloud Tasks will retry where applicable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
      security:
        - HTTPBearer: []
components:
  schemas:
    AgentExecIn:
      properties:
        argv:
          items:
            type: string
          type: array
          maxItems: 32
          minItems: 1
          title: Argv
          description: >-
            Arguments after the hermes binary, e.g. ["status"] or
            ["config","show"]
          examples:
            - - status
        confirm:
          type: boolean
          title: Confirm
          description: Required true for tier-3 destructive commands
          default: false
        timeout_seconds:
          type: integer
          maximum: 300
          minimum: 1
          title: Timeout Seconds
          default: 60
      type: object
      required:
        - argv
      title: AgentExecIn
      description: Run an allowlisted `hermes <argv…>` command in the agent pod (no shell).
    AgentExecOut:
      properties:
        exit_code:
          type: integer
          title: Exit Code
        stdout:
          type: string
          title: Stdout
        stderr:
          type: string
          title: Stderr
        argv:
          items:
            type: string
          type: array
          title: Argv
        duration_ms:
          type: integer
          title: Duration Ms
        tier:
          type: integer
          title: Tier
      type: object
      required:
        - exit_code
        - stdout
        - stderr
        - argv
        - duration_ms
        - tier
      title: AgentExecOut
    ErrorBody:
      properties:
        detail:
          anyOf:
            - type: string
            - items: {}
              type: array
          title: Detail
          description: Human-readable error, or validation error list
          examples:
            - Agent not found
      type: object
      required:
        - detail
      title: ErrorBody
      description: Standard FastAPI / SEAOTTER error payload.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT or so_ API key
      description: >-
        Clerk session JWT for the web app (active organization required), or an
        organization-scoped SEAOTTER access key (`so_…`) from POST
        /api/v1/api-keys for programmatic / docs try-it / MCP use. The same
        `so_…` value is both `Authorization: Bearer so_…` and
        `SEAOTTER_API_KEY`.

````