How to connect Sevdesk to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect Sevdesk from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

Sevdesk tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Sevdesk call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

The engines teach three causes: a missing or non-admin token, a plan tier that lacks the module, with materials management and similar modules rejecting with 403 even when the token is a valid admin token, and a wrong token: header. The hosted-flow causes are the same shape: the pasted key came from a non-admin user, the plan does not include the module the tool touches, or the agent passed a placeholder value from documentation, which this API answers with 403 like everything else. Check the token's user and the plan before assuming the connection is broken.

Ask the agent to diagnose it:

Tell me which SevDesk tool failed and quote the exact error. Then list the tools you have access to so we can see whether the failure is module-scoped or argument-scoped. Do not retry the failed call yet.

SevDesk's rate limit is not published, the AIO calls it hidden, and countAll-style endpoints cap their results, so an agent walking many objects is the traffic shape that stalls. The response is to narrow the work, not to retry in a loop: fewer objects per call, a date-bounded query, and the agent telling you what it intends to enumerate before it starts. A list that comes back short can also be the token's scope rather than the rate limit, so have the agent report what it actually got.

Ask the agent to diagnose it:

Tell me how many SevDesk calls you made in the last minute and what you were enumerating. Quote the result count versus what you expected. Do not call SevDesk again until I reply.

The taught fixes for this symptom are Claude Code config issues: checking client config, restarting, forcing tool discovery. None apply to a hosted flow. The real causes are: pairing incomplete, fixed by rerunning hermes clawlink begin and hermes clawlink finish and confirming SevDesk shows as connected; schemas loading on demand, so the opening call in a fresh session can arrive before the catalog and needs one retry; and a wrong tool name, where the error lists the closest real ones.

Ask the agent to diagnose it:

List the SevDesk tools you actually have access to. If there are none, say so plainly. If there are, tell me which one gets contacts and use that exact name.

Double-check that the API key for Sevdesk has the right scopes or account access. A valid key can still be too limited for some reads or writes.

Yes. ClawLink is the fastest way to connect Hermes to Sevdesk: link your Sevdesk account once in the browser and Hermes Agent can call the Sevdesk API through 115 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect Sevdesk in the dashboard and Hermes can use it from the next message — no config files, and the Sevdesk key you paste is stored server-side instead of in your environment.

About two minutes. Sign in, click Connect next to Sevdesk in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual API key setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Sevdesk working from chat.

The per-user API token from Settings → Users → your user → API Token, which is under Erweiterungen → Integrationen in the German UI. It is admin-only, 32 characters of hex, never expires, and dies with the admin user it belongs to. In Germany, Buchhaltung Pro or higher is required to create one at all. You paste it once into the hosted setup page; the key itself lives server-side from then on.

A non-admin token gets 403s on the write tools, and the plan itself gates modules: endpoints for modules your plan does not include reject with 403 even with a valid admin token. That is a SevDesk-side fact, not a ClawLink bug: the connection is only as powerful as the token and the plan behind it.

Contacts, accounting contacts, invoices including account invoices, check accounts and their transactions, credit notes, clearing accounts, communication ways, custom fields and dictionary entries, CSV export of credit notes, booking invoice amounts, and creating accounting contacts and check account transactions. Booking amounts and creating transactions are the writes to be deliberate about, since they move the books.

The risk framing that fits SevDesk is a token with full bookkeeping access living where it should not. Here the key is server-side, revocable from the dashboard, and rotating the key in SevDesk kills the connection immediately. Least privilege still applies: generate the token with the access you intend, and keep write prompts explicit, which is the middleware-with-approval pattern the engines recommend, just run for you.

Because that claim would be false. The engines correctly say a connection without some credential is impossible, and third-party platforms holding the key behind the scenes is the workaround they teach. That is this architecture: the key exists, you generate it, and a platform holds it for you so the agent never sees it.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.