openapi/CAPABILITIES.md

Hanzo Capability Manifest

Every capability the API serves, at v1.801.400. GENERATED from hanzo.yaml — which is itself generated from hanzoai/cloud's own emission — so a name is on this page if and only if a router registered operations under it. Nothing here is authored, and there is nothing to author: a capability appears the release it starts being served and leaves the release it stops.

Identity & Trust

who you are · what you may touch · where secrets live

Capability	Operations	What it is
iam	173	Package iam is Hanzo's identity provider: users, organizations, applications, and the OIDC/OAuth2 endpoints every Hanzo service authenticates against.
admin	87	Package admin is the operator's view of the fleet: orgs, users, roles, spend and system health.
authz	3
kms	7	Package kms is secret custody: your org's secrets sealed at rest, plus threshold signing.
security	7	Package security is secret scanning for your code: submit sources, get findings, masked never raw.
keys	3	Package account is your own account: API keys you mint and revoke, org onboarding, and wallet top-up.
csrf	1	Package account is your own account: API keys you mint and revoke, org onboarding, and wallet top-up.
org	12	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
orgs	3	Package account is your own account: API keys you mint and revoke, org onboarding, and wallet top-up.
team	19	Package team is your org's shared workspace: documents edited together, files, seats, and agents as teammates.
audit	1	Package auditlog is your org's tamper-evident audit trail: every security-relevant event, hash-chained and readable.
compliance	17	Package compliance is your KYC/KYB onboarding, accreditation records, and the evidence trail behind them.
risk	10	Package risk is HANZO RISK's model plane: the per-organisation feature surface and the per-organisation models trained on it.
validators	4	Package validators is one-click validator onboarding: prove your Genesis NFT, get a node provisioned, queue its registration.
wallets	8	Package wallets is blockchain key custody: create wallets, rotate their keys, and sign with them.
entitlements	1	Package entitlements is what your org may run: what the plan grants, and which of those products are switched on.
avatar	2	Package account is your own account: API keys you mint and revoke, org onboarding, and wallet top-up.

Intelligence

models · agents · evaluation — the mind of the cloud

Capability	Operations	What it is
ai	208	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
router	35	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
agent	4	Package agent is a conversation that uses your org's own tools to get an answer.
agents	31	Package agents is autonomous agents for your org: define them, run them, keep every run.
ml	14	Package ml is model serving and training: deploy a model behind an endpoint, run a training job, tune it with experiments.
train	10	Package ml is model serving and training: deploy a model behind an endpoint, run a training job, tune it with experiments.
finetune	9	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
evals	16	Package eval is scoring a model on your own data, with a judge you choose.
benchmark	6	Package benchmark is one honest score for any model, on the tests everyone quotes.
research	8	Package research is every experiment you have ever run, kept and comparable.
prompts	6	Package prompts is your prompt library, versioned, so nothing changes silently.
exec	12	Package exec is the code interpreter: run a snippet in a sandbox and move files in and out.
files	12	Package exec is the code interpreter: run a snippet in a sandbox and move files in and out.
upload	12	Package exec is the code interpreter: run a snippet in a sandbox and move files in and out.
download	12	Package exec is the code interpreter: run a snippet in a sandbox and move files in and out.
mcp	3	Package tools is everything your org can call, in one list: connector actions, functions, agents, skills and your own MCP servers.
tools	8	Package tools is everything your org can call, in one list: connector actions, functions, agents, skills and your own MCP servers.
skills	6	Package skills is the skill catalogue an AI client reads to learn what it can do.
ask	1	Package ask is a plain-language question about your business, answered with real numbers.
code	7	Package code is search and symbols across your repos, for you and your agents.
memory	7	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
rag	5	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
engine	4	Package engine is Hanzo Engine: which models the serving runtime has loaded, and the GPUs under it.
run	1	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.
runner	3	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.
chat	2	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
completions	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
embeddings	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
messages	2	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
rerank	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
models	3	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
images	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
audio	4	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
videos	3	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
responses	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
translate	3	Package translate is text in, the same text out in the language you asked for.
summary	1	Package o11y is your logs, metrics and traces: ship them in, query them, chart them.
documents	2	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
docs	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
feedback	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
generate-text-to-speech-audio	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
generate-text-to-speech-audio-stream	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
process-speech-to-text	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
query	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
query_multiple	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
dev-bridge	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
install-patch	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
provider-flags	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
traffic	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
wecom-bot	2	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
health	1	Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.

Data

the stores every capability writes to and reads from

Capability	Operations	What it is
s3	12	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
base	1	Package base is managed Hanzo Base: a hosted backend for your app — collections, records, access rules and sign-in.
collections	12	Package base is managed Hanzo Base: a hosted backend for your app — collections, records, access rules and sign-in.
kv	4	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
vector	6	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
sql	4	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
datastore	4	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
docdb	4	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
search	6	Package provisioning is one-click data add-ons: a SQL, key-value, document, vector, search or object store, wired straight into your app.
index	17	Package index is fast full-text search over your own data, typos forgiven.
indexers	1	Package graph is chain data: your block indexers and how far each has caught up, plus the on-chain price feeds.
oracles	1	Package graph is chain data: your block indexers and how far each has caught up, plus the on-chain price feeds.
kb	9	Package knowledge is your team's wiki and your agents' memory, searchable by meaning.
catalog	8	Package catalog is one place to browse every project, app and site built here.
sync	6	Package sync is data sync: link two endpoints and keep them in step, on a webhook, on a schedule, or on demand.
crawl	1	Package crawl is any web page turned into clean markdown a model can read.
scrape	1	Package websearch is a web search and a page fetch your agents can call.
websearch	6	Package websearch is a web search and a page fetch your agents can call.

Streams

messaging · durable tasks · async orchestration

Capability	Operations	What it is
tasks	24	Package tasks is Hanzo Tasks: durable workflows that survive a crash, with every run visible and replayable.
pubsub	18	Package pubsub is your message bus: publish, subscribe, and durable streams your apps read at their own pace.
mq	15	Package mq is queue and stream admin for your org: create them, watch them drain, ack what you pulled.
notify	4	Package notify is transactional email and SMS, sent through your org's own provider credential.
automations	18	Package automations is workflows that run themselves, on a schedule or a webhook.
auto	11	Package auto is Hanzo Auto: build a flow from triggers and actions, publish it, and watch every run.
flow	8	Package flow is Hanzo Flow: build an agent workflow on a visual canvas, run it, and read every run.
webhooks	8	Package webhooks is how your app hears about events: register an endpoint, pick the events, get each one delivered and signed.
event	3	Package analytics is product analytics: send an event, read back who did what.
channels	7	Package channels is one inbox for the chat apps you connect — Discord, Slack, Teams, Telegram.
destinations	5	Package destinations is your events forwarded to the ad and analytics tools you use.
connector	1	Package integrations is how your org connects third-party accounts like Slack, and revokes them.
connectors	8	Package integrations is how your org connects third-party accounts like Slack, and revokes them.
pipelines	1	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.

Observability

see everything — telemetry · analytics · usage

Capability	Operations	What it is
o11y	364	Package o11y is your logs, metrics and traces: ship them in, query them, chart them.
sentry	23	Package o11y is your logs, metrics and traces: ship them in, query them, chart them.
logs	3
traces	4
metrics	4
errors	1	Package analytics is product analytics: send an event, read back who did what.
analytics	4	Package analytics is product analytics: send an event, read back who did what.
insights	2	Package analytics is product analytics: send an event, read back who did what.
usage	11	Package usage is what your org ran and what it cost, broken down per account.
openapi	1

Commerce

the economy — meter · price · bill · reward

Capability	Operations	What it is
commerce	13	Package commerce is selling: checkout, subscriptions, invoices, spend alerts, payment webhooks and the storefront catalog.
store	34	Package commerce is selling: checkout, subscriptions, invoices, spend alerts, payment webhooks and the storefront catalog.
marketplace	6	Package marketplace is the shop for tools and agents: browse, install into your project, publish your own free or priced.
billing	26	Package billing is your org's balance, what it has spent, and the cards it pays with.
pricing	25	Package pricing is the price list: what every model, provider, GPU tier, tool and hosting plan costs.
plans	20	Package plan is the plan catalog: every tier you can buy, what it costs, and what it grants.
finance	8
books	25	Package books is double-entry accounting: chart of accounts, ledger, bank reconciliation, and the reports that prove the books balance.
captable	31	Package captable is your cap table: stakeholders, share classes, grants, SAFEs, rounds, and who owns what.
crm	20	Package crm is your sales pipeline: the companies, the people, the deals in play.
referrals	2	Package referrals is credit for both sides when someone you refer actually spends.
affiliates	10	Package affiliates is a partner program that pays commission on what your referrals spend.
authors	5	Package authors is a royalty for open-source work: your repo runs, you get paid.
licensing	6
x402	1	Package x402 is pay-per-request over HTTP 402: quote a price, take the payment, serve the resource.
marketing	35	Package marketing is lifecycle email: drip sequences that reach the right people.
campaign	11	Package campaign is one go-to-market push across paid, organic and email at once.
ads	7	Package ads is your paid ad campaigns, launched and paused from one place.
experiments	7	Package experiments is A/B testing anything: a flag, an ad, a subject line, a model.
enablement	3	Package pricing is the price list: what every model, provider, GPU tier, tool and hosting plan costs.

Platform

the cloud fabric — deploy · provision · route · host

Capability	Operations	What it is
platform	41	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.
cloud	5	Package venue is bring your own cloud: link a DigitalOcean, AWS or GCP account and its clusters show up ready to run work.
deploy	21	Package deploy is Hanzo CD: see what each app is running, sync it, and roll back a bad release.
projects	15	Package projects is where your sites live: create one, deploy a build, roll back to any release.
sites	7	Package projects is where your sites live: create one, deploy a build, roll back to any release.
builds	1	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.
releases	1	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.
environments	1	Package platform is Hanzo PaaS: deploy containers to your own tenant namespace — builds, releases, environments, logs, custom domains.
registry	6	Package registry is your container and package registry: push images, pull them back, see what you store.
gateway	3	Package gateway is live control of the policy your API applies to every incoming request: CORS, rate limits, cache TTL and allowed methods, changed without a redeploy.
ingress	18	Package ingress is your front door: automatic TLS certificates and hostname routing to any backend, changed live.
dns	6	Package dns is your DNS records: the zones and records behind every name you point at Hanzo.
domain	7	Package domain is Hanzo Domains: search a name, see the price, buy it from your prepaid wallet.
cloudflare	33	Package cloudflare is your Cloudflare account, managed from Hanzo: zones, Pages, Workers, Workers AI, R2, KV and D1.
networks	3	Package zt mounts the Hanzo Cloud NETWORKING surface: the tenant's Hanzo Zero Trust footprint — overlay networks, their routers and mesh services — served as clean, org-scoped REST off the unified cloud binary and fronting the Hanzo Zero Trust controller (hanzoai/zt, an OpenZiti-based fabric).
vpcs	4	Package do is the org-scoped private-network surface — /v1/vpcs and /v1/balancers — carved out of Hanzo's OWN house DigitalOcean account.
balancers	4	Package do is the org-scoped private-network surface — /v1/vpcs and /v1/balancers — carved out of Hanzo's OWN house DigitalOcean account.
mesh	1	Package zt mounts the Hanzo Cloud NETWORKING surface: the tenant's Hanzo Zero Trust footprint — overlay networks, their routers and mesh services — served as clean, org-scoped REST off the unified cloud binary and fronting the Hanzo Zero Trust controller (hanzoai/zt, an OpenZiti-based fabric).
k8s	5	Package visor is the compute you rent from Hanzo: machines, GPUs and clusters — launch one, resize it, tear it down.
clusters	6	Package visor is the compute you rent from Hanzo: machines, GPUs and clusters — launch one, resize it, tear it down.
machines	8	Package visor is the compute you rent from Hanzo: machines, GPUs and clusters — launch one, resize it, tear it down.
compute	7	Package visor is the compute you rent from Hanzo: machines, GPUs and clusters — launch one, resize it, tear it down.
gpus	2	Package visor is the compute you rent from Hanzo: machines, GPUs and clusters — launch one, resize it, tear it down.
fleet	6	Package visor is the compute you rent from Hanzo: machines, GPUs and clusters — launch one, resize it, tear it down.
plugins	4	Package plugin is what each host is running, and how to change it: enable, disable, reload, or pin a service to a version.
flags	9	Package flags is feature flags: ship it dark, then turn it on for who you pick.

Applications

the user-facing surfaces built on all of the above

Capability	Operations	What it is
git	54	Package git is Git hosting for your org: create repos, clone, push, and see what they cost.
templates	5	Package templates is a gallery of starter kits you can deploy as they come.
blueprint	3	Package blueprint is what a template costs to run, worked out before you deploy.
integrations	32	Package integrations is how your org connects third-party accounts like Slack, and revokes them.
bot	10	Package bot is your own machines, connected and ready to take a command.
bots	3	Package bots is a bot doing your work on a real desktop, live, while you watch.
world	6	Package world is a live news feed filtered to what your project cares about.
tracker	10	Package tracker is your org's issue tracker: projects, issues, and the filters to find them.
framework	19	Package framework is document types you define: describe a record once, then create, list, submit and cancel documents against it.
content	6	Package content is marketing content from draft to published, on every channel.
guide	19	Package guide is a step-by-step checklist that gets your business running on AI.
help	4	Package help is a support desk: customers file tickets, your team answers them.
meet	2	Package meet is the virtual office: it decides who may join a room and mints the short-lived token that lets them in.
share	2	Package share is a public URL for a service on your own machine, and a list of what you have open.
social	13	Package social is posting to every social account you own, now or on a schedule.
links	11	Package link is the unified AI login manager's registry: the org+user-scoped record of WHICH provider accounts (Claude Max, ChatGPT Plus, a Hanzo API key, a raw provider key) a developer has signed into, ON WHICH MACHINES, with each account's latest usage snapshot.
esign	13	Package esign is a document out for signature, signed and filed with an audit trail.
dataroom	17	Package dataroom is a secure document room you share by link and watch page by page.
company	22	Package company is incorporation end to end: pick a structure, add founders, pay, file, and e-sign.
legal	11	Package legal is the paperwork your company needs, drafted, signed and filed.
prefs	2	Package prefs is your own settings — theme, density, pinned nav — following you across every Hanzo app.
settings	2	Package settings is how an org configures each product it uses, secret fields included.
embed	1	Package account is your own account: API keys you mint and revoke, org onboarding, and wallet top-up.
functions	11	Package functions is your serverless code: publish it, call it over HTTP, watch every run and what it cost.
sbom	3	Package sbom is what is inside a container image: every component, resolvable by digest or image ref.