diff --git a/app/src/main/java/com/m57/hermescontrol/data/remote/HermesApiService.kt b/app/src/main/java/com/m57/hermescontrol/data/remote/HermesApiService.kt
index 10177622..9950e430 100644
--- a/app/src/main/java/com/m57/hermescontrol/data/remote/HermesApiService.kt
+++ b/app/src/main/java/com/m57/hermescontrol/data/remote/HermesApiService.kt
@@ -126,7 +126,9 @@ interface HermesApiService {
 
     @GET("api/sessions/{id}/messages")
     suspend fun getSessionMessages(
-        @Path("id") sessionId: String,
+        // Preserve slashes in session IDs — backend generates IDs containing '/' characters (issue #468).
+        // Contract: The server-generated sessionId must only contain URL-safe characters (no ?, #, or spaces).
+        @Path("id", encoded = true) sessionId: String,
     ): Response<SessionMessagesResponse>
 
     @GET("api/sessions/stats")
@@ -134,7 +136,9 @@ interface HermesApiService {
 
     @PUT("api/sessions/{id}/rename")
     suspend fun renameSession(
-        @Path("id") sessionId: String,
+        // Preserve slashes in session IDs — backend generates IDs containing '/' characters (issue #468).
+        // Contract: The server-generated sessionId must only contain URL-safe characters (no ?, #, or spaces).
+        @Path("id", encoded = true) sessionId: String,
         @Body body: SessionRenameRequest,
     ): Response<Unit>
 
@@ -145,7 +149,9 @@ interface HermesApiService {
 
     @DELETE("api/sessions/{id}")
     suspend fun deleteSession(
-        @Path("id") sessionId: String,
+        // Preserve slashes in session IDs — backend generates IDs containing '/' characters (issue #468).
+        // Contract: The server-generated sessionId must only contain URL-safe characters (no ?, #, or spaces).
+        @Path("id", encoded = true) sessionId: String,
     ): Response<Unit>
 
     @POST("api/sessions/prune")
@@ -155,7 +161,9 @@ interface HermesApiService {
 
     @GET("api/sessions/{id}/prompt")
     suspend fun getSessionPrompt(
-        @Path("id") sessionId: String,
+        // Preserve slashes in session IDs — backend generates IDs containing '/' characters (issue #468).
+        // Contract: The server-generated sessionId must only contain URL-safe characters (no ?, #, or spaces).
+        @Path("id", encoded = true) sessionId: String,
     ): Response<SessionPromptResponse>
 
     @GET("api/system/stats")