Skip to main content
POST
Create Sidecar Approval Request

Headers

hoop-sidecar-token
string

The token returned when the sidecar was created. Omit it when sending hoop-sidecar-identity.

hoop-sidecar-identity
string

A Kubernetes or Google service account JWT, raw, that a sidecar service account mapping allows. Omit it when sending hoop-sidecar-token.

Body

application/json

The request body resource

approval_rule
string
required

The access request rule that decides who may approve this statement

It must be the rule the sidecar's stored configuration names for this listener. The rule carries the approver groups, the approval count and the force-approval list; the sidecar holds none of that policy and only names it.

Bounded at 254 to match what a rule name may be.

Maximum string length: 254
Example:

"payments-approvers"

listener_name
string
required

The sidecar listener the statement arrived on, at most 1024 bytes

Example:

"appdb"

payload
string
required

The statement to approve, base64 encoded

Example:

"REVMRVRFIEZST00gdXNlcnM7"

reserve
boolean

Reserve an approved request instead of spending it

The review moves to PROCESSING, and the sidecar settles it with what the upstream answered. A plane that predates this field ignores it and spends the approval at release.

Example:

false

Response

OK

forward
boolean

Whether the sidecar may release the statement it held

True only on the request that consumed or reserved an approved request, and only once per claim. False while the approval request waits or a reservation is in flight, and false forever once it is rejected, revoked or expired.

Example:

false

review
object

The approval request the statement is waiting on, or the one that released it