Protocol adapter · 2 of 3
OpenAPI transport adapter
The OpenAPI adapter performs a capability-scope check and submits the configured HTTP request. It does not itself make the canonical policy decision, check Authority, durably capture an Attempt, or produce AVAR evidence. A standalone call is not proof of governed execution.
Availability
How you get the software. Aarmos is distributed to authorized workspaces as signed artifacts. Signing in establishes your account; evaluation access requires approval. Once approved, your evaluation workspace is created and the 30-day evaluation period begins. Nothing downloads until you ask for it. Public npm is not a supported distribution channel for Aarmos product or runtime packages. The open AVAR verification and conformance packages are the supported public npm surface, so anyone can check a receipt without our software.
The CLI is not publicly distributed. This page describes the adapter interface, not an available software release or a qualified deployment procedure.
Standalone interface example
This reference example assumes the adapter and its transport configuration are already supplied. It is not a policy configuration or a governed execution example.
const result = await openapiAdapter.invoke({
target: "openapi://billing/list_invoices",
args: {},
});Transport and governance boundaries
- The adapter resolves an operation from the configured API description and submits its HTTP request.
- Write methods require an explicit matching capability scope. A scope check is not canonical authorization.
- Policy decisions, durable pre-dispatch evidence and approval binding belong to the supported composed runtime path, not this adapter.
- Live enforcement qualification is limited to the governed email-send path; it does not qualify this OpenAPI interface.
For a governed deployment, the agent must use the supported runtime entry point. Direct target credentials or another network route can bypass it; installing an adapter alone does not prevent that access. Browser policy controls and Bridge permissions are distinct from customer-operated runtime governance.
Evidence describes authorization, attempts, forwarding and observations within the supported visibility boundary. It does not establish a downstream business outcome.
See the threat model for deployment responsibilities and limits.