> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get Sidecar Service Account > Get one sidecar service account by its ID. ## OpenAPI ````yaml https://use.hoop.dev/api/openapiv3.json get /sidecar-service-accounts/{id} openapi: 3.0.3 info: contact: email: help@hoop.dev name: Help url: https://help.hoop.dev description: >- Hoop.dev is an access gateway for databases and servers with an API for packet manipulation license: name: MIT url: https://opensource.org/license/mit termsOfService: https://hoop.dev/docs/legal/tos title: Hoop Api version: 1.224.1 servers: - url: https://use.hoop.dev/api security: [] tags: - description: > Hoop implements Oauth2 and OIDC protocol to authenticate users in the system. To obtain a valid access token users need to authenticate in their own identity provider which is generated as a JSON response to the endpoint `http(s)://use.hoop.dev/api/login`. The identity provider them redirects the user to the callback endpoint containing the access token. The recommended approach of obtaining an access token is by visiting the Webapp main's page or using the **Hoop command line**. Example: ```sh hoop config create --api-url https://use.hoop.dev # save the token after authenticating at $HOME/.hoop/config.toml hoop login # show token information hoop config view --raw ``` With an access token you could use any HTTP client to interact with the documented endpoints. The token must be sent through the `Authorization` header. Example: ```sh # obtain the current configuration of the server curl https://use.hoop.dev/api/serverinfo -H "Authorization: Bearer $ACCESS_TOKEN" ``` name: Authentication - description: > Users are active and assigned to the default organization when they signup. A user could be set to an inactive state preventing it from accessing the platform, however it’s recommended to manage the state of users in the identity provider. - The `sub` claim is used as the main identifier of the user in the platform. - The profile of the user is derived from the id_token claims `email` and `name`. When a user authenticates for the first time, it performs an automatic signup that persist the profile claims along with it’s unique identifier. ​ ### Groups Groups allows defining who may access or interact with certain resources. - For connection resources it’s possible to define which groups has access to a specific connection, this is enforced when the Access Control feature is enabled. - For review resources, it’s possible to define which groups are allowed to approve an execution, this is enforced when the Review feature is enabled. > This resource could be managed manually via Webapp or propagated by the identity provider via ID Token. In this mode, groups are sync when a user performs a login. ### Roles - The `admin` group is a special role that grants full access to all resources This role should be granted to users that are responsible for managing the Gateway. All other users are regular, meaning that they can access their own resources and interact with connections. name: User Management - name: Machine Identities - description: Routes used to manage and obtain information about the runtime server. name: Server Management - description: Features available in the gateway. See also **Plugin** resources. name: Features - description: >- Proxy manager endpoints controls how clients connect via gRPC in the gateway. These endpoints are meant to be used when a client is initialized via `hoop proxy-manager`. name: Proxy Manager - name: Connections - name: Agents - name: Sidecars - name: Runbooks - name: Guard Rails - name: Reviews - name: Sessions - name: Organization Management - name: Reports - description: > Security audit log API. Only users in the **admin** group can access these endpoints. Audit log entries record security-relevant events (who performed an action, when, on which resource, and whether it succeeded). Use the list endpoint with filters to query by actor, resource type, action, outcome, or date range. Results are paginated and ordered by `created_at` descending. name: Audit Logs paths: /sidecar-service-accounts/{id}: get: tags: - Sidecars summary: Get Sidecar Service Account description: Get one sidecar service account by its ID. parameters: - description: Sidecar service account ID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/openapi.SidecarServiceAccount' description: OK '403': content: application/json: schema: $ref: '#/components/schemas/openapi.HTTPError' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/openapi.HTTPError' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/openapi.HTTPError' description: Internal Server Error components: schemas: openapi.SidecarServiceAccount: properties: adopt_existing_sidecars: description: |- Lets a matching token reach a sidecar an admin created with a token, that no identity is bound to yet, and binds it. The sidecar's token keeps working. Without it the token is refused there example: false type: boolean allow_any_subject: description: Allows the bare * pattern, which admits every subject of the issuer example: false type: boolean audience: description: >- The aud the tokens must carry: the control plane URL the sidecar uses. An issuer and audience pair belongs to one organization example: https://hoop.example.com type: string claim: description: >- The claim matched against subject_pattern * sub - The subject, for a Kubernetes service account * email - The email, for a Google service account. The token must carry email_verified true enum: - sub - email example: sub type: string created_at: description: Creation timestamp readOnly: true type: string created_by: description: The admin who created this mapping readOnly: true type: string id: description: The unique identifier of this resource format: uuid readOnly: true type: string issuer: description: |- The exact iss of the tokens. An https URL, where the control plane fetches the keys through OIDC discovery, unless jwks is set example: >- https://container.googleapis.com/v1/projects/my-project/locations/europe-west1/clusters/eu type: string jwks: description: |- A static JWKS for an issuer the control plane cannot reach. Omitted means OIDC discovery at {issuer}/.well-known/openid-configuration type: object name: description: A label for this mapping, unique in the organization example: gke-eu type: string name_template: description: >- The name of the sidecar a matching token reaches. {1} is the text the * matched. A sidecar that exists with this name is used when it is bound to the same identity, or to none (see adopt_existing_sidecars) example: gke-eu-{1} type: string org_id: description: Organization ID format: uuid readOnly: true type: string subject_pattern: description: |- An exact value, or one with a single * that matches one or more characters. A bare * needs allow_any_subject. For the issuer https://accounts.google.com it must end in a literal @.iam.gserviceaccount.com example: system:serviceaccount:*:hoop-sidecar type: string updated_at: description: Last update timestamp readOnly: true type: string required: - audience - claim - issuer - name - name_template - subject_pattern type: object openapi.HTTPError: properties: message: example: the error description type: string type: object ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.