Create Guard Rail Rules
curl --request POST \
--url https://use.hoop.dev/api/guardrails \
--header 'Content-Type: application/json' \
--data '
{
"name": "my-strict-rule",
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
'import requests
url = "https://use.hoop.dev/api/guardrails"
payload = {
"name": "my-strict-rule",
"attributes": ["production", "pii"],
"connection_ids": ["15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7", "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'my-strict-rule',
attributes: ['production', 'pii'],
connection_ids: ['15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7', '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'],
description: 'description about this rule',
input: {},
output: {},
sidecar_spec: {},
sidecar_targets: [{listener_name: 'appdb', sidecar_id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'}]
})
};
fetch('https://use.hoop.dev/api/guardrails', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/guardrails",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'my-strict-rule',
'attributes' => [
'production',
'pii'
],
'connection_ids' => [
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'
],
'description' => 'description about this rule',
'input' => [
],
'output' => [
],
'sidecar_spec' => [
],
'sidecar_targets' => [
[
'listener_name' => 'appdb',
'sidecar_id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/guardrails"
payload := strings.NewReader("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://use.hoop.dev/api/guardrails")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/guardrails")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"created_at": "2024-07-25T15:56:35.317601Z",
"description": "description about this rule",
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"input": {},
"managed_by": "hoop",
"name": "my-strict-rule",
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
],
"updated_at": "2024-07-25T15:56:35.317601Z"
}{
"message": "the error description"
}{
"message": "the error description"
}{
"message": "the error description"
}Guard Rails
Create Guard Rail Rules
Create Guard Rail Rules
POST
/
guardrails
Create Guard Rail Rules
curl --request POST \
--url https://use.hoop.dev/api/guardrails \
--header 'Content-Type: application/json' \
--data '
{
"name": "my-strict-rule",
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
'import requests
url = "https://use.hoop.dev/api/guardrails"
payload = {
"name": "my-strict-rule",
"attributes": ["production", "pii"],
"connection_ids": ["15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7", "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'my-strict-rule',
attributes: ['production', 'pii'],
connection_ids: ['15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7', '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'],
description: 'description about this rule',
input: {},
output: {},
sidecar_spec: {},
sidecar_targets: [{listener_name: 'appdb', sidecar_id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'}]
})
};
fetch('https://use.hoop.dev/api/guardrails', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/guardrails",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'my-strict-rule',
'attributes' => [
'production',
'pii'
],
'connection_ids' => [
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'
],
'description' => 'description about this rule',
'input' => [
],
'output' => [
],
'sidecar_spec' => [
],
'sidecar_targets' => [
[
'listener_name' => 'appdb',
'sidecar_id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/guardrails"
payload := strings.NewReader("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://use.hoop.dev/api/guardrails")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/guardrails")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"created_at": "2024-07-25T15:56:35.317601Z",
"description": "description about this rule",
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"input": {},
"managed_by": "hoop",
"name": "my-strict-rule",
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
],
"updated_at": "2024-07-25T15:56:35.317601Z"
}{
"message": "the error description"
}{
"message": "the error description"
}{
"message": "the error description"
}Body
application/json
The request body resource
Unique name for the rule
Example:
"my-strict-rule"
Attributes associated with this guardrail rule
Example:
["production", "pii"]
List of connection IDs that this guardrail applies to
Example:
[
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
]
The rule description
Example:
"description about this rule"
The input rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{
"name": "deny-select",
"description": "<optional-description>",
"input": {
"rules": [
{"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "message": "<optional-message>"}
]
},
"output": {
"rules": [
{"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"}
]
}
}
Show child attributes
Show child attributes
The output rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{
"name": "deny-select",
"description": "<optional-description>",
"input": {
"rules": [
{"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "message": "<optional-message>"}
]
},
"output": {
"rules": [
{"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"}
]
}
}
Show child attributes
Show child attributes
SidecarSpec is this rule in the SIDECAR's own vocabulary, which the
gateway's fields above do not share: seven rule types, an operations scope on every one of them,
and action: defer to hand the verdict to a Rego policy. It holds the
guardrails block the listener receives: {"rules": [...]}.
Omitted on a rule no sidecar runs.
SidecarTargets names the sidecar LISTENERS that must enforce this rule, which is how a control plane distributes it to a fleet. A listener, not a sidecar: the listener carries the protocol, and the protocol decides which rule types it can run at all.
A POINTER because absent and empty are different instructions: absent leaves the bindings exactly as they are, and [] unbinds the rule from every sidecar. Without that distinction any write that did not mention the field -- a script fixing a typo, the gateway's own UI, an MCP call -- would silently unbind a rule from the whole fleet.
Show child attributes
Show child attributes
Response
Created
Attributes associated with this guardrail rule
Example:
["production", "pii"]
List of connection IDs that this guardrail applies to
Example:
[
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
]
The time the resource was created
Example:
"2024-07-25T15:56:35.317601Z"
The rule description
Example:
"description about this rule"
The resource identifier
Example:
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
The input rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{
"name": "deny-select",
"description": "<optional-description>",
"input": {
"rules": [
{"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "name": "<optional-name>", "message": "<optional-message>"}
]
},
"output": {
"rules": [
{"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"}
]
}
}
Show child attributes
Show child attributes
Set to "hoop" when the rule is materialized and lifecycle-managed by a protection profile; managed rules are read-only through this API
Example:
"hoop"
Unique name for the rule
Example:
"my-strict-rule"
The output rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{
"name": "deny-select",
"description": "<optional-description>",
"input": {
"rules": [
{"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "name": "<optional-name>", "message": "<optional-message>"}
]
},
"output": {
"rules": [
{"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"}
]
}
}
Show child attributes
Show child attributes
SidecarSpec is this rule in the sidecar's own vocabulary; see the request type. Present when the rule carries one.
The sidecar listeners this rule is bound to, and therefore distributed to
Show child attributes
Show child attributes
The time the resource was updated
Example:
"2024-07-25T15:56:35.317601Z"
Was this page helpful?