# Hoop.dev - Automated Access and Data Protection - [Runtime control for AI Agents](https://mintlify.hoop.dev/docs/introduction/getting-started.md): A protocol-aware reverse proxy between AI and everything it can touch. - [Quickstart](https://mintlify.hoop.dev/docs/introduction/quickstart.md): What to do with a running Sidecar - [Architecture](https://mintlify.hoop.dev/docs/introduction/architecture.md): The components of a Hoop deployment, the connections between them, and how each tier scales. - [Sidecar](https://mintlify.hoop.dev/docs/core-concepts/sidecar.md): The engine. No external dependency, connected directly to the resource. - [Container Images](https://mintlify.hoop.dev/docs/install/container-images.md): The images that run the Sidecar, what each one contains, and when to pick which. - [Kubernetes](https://mintlify.hoop.dev/docs/install/kubernetes.md) - [Connect a Sidecar](https://mintlify.hoop.dev/docs/control-plane/connect-sidecar.md): Issue a token, point a Sidecar at the Control Plane, and let it pull its configuration. - [Config File Reference](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/config-file.md): Every section of the Sidecar config file, and what startup refuses - [Service Accounts](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/service-accounts.md): Let every Sidecar authenticate with the service account it already has. No token to issue before a deploy, one entry per cluster, and a Sidecar is created on its first handshake. - [Identity Mapping](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/identity-mapping.md): Map credentials, clusters, projects and workspaces to Sidecars. Every supported layout, with tokens, Kubernetes service accounts and Google service accounts side by side. - [Guardrail Rules Reference](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/policy-rules.md): Write a guardrail rule, pick deny or defer, and hand the judgement call to Rego - [AI Analyzer Reference](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/risk-analysis.md): Classify statements with a language model and block on the risk it reports - [Review Status for Agents](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/agent-reviews.md): Let an agent learn when a person decides a held statement: the review fields on a denial, a status path on the http listener, and an MCP server, none of which needs the Sidecar token. - [Architecture](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/components.md): How a request flows through the Sidecar, and how to place it in a real deployment - [Kerberos and SQL Server](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/kerberos.md): Inspect MSSQL and Postgres sessions where the user authenticates with a Kerberos ticket - [PostgreSQL](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/postgres.md): What the pgwire codec decodes, terminates and masks on a postgres lane - [ClickHouse](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/clickhouse.md): Protect ClickHouse native TCP queries with guardrails, AI risk analysis, audit and response masking, alone or beside PostgreSQL and MySQL lanes - [MySQL](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/mysql.md): What the MySQL codec decodes, what it refuses, and how a mysql lane masks - [SQL Server](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/mssql.md): What the TDS codec decodes on an mssql lane, and who terminates which TLS - [MongoDB](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/mongodb.md): What the MongoDB codec decodes, how commands classify, and how a mongodb lane masks BSON - [gRPC](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/grpc.md): The grpc lane: an in-process HTTP/2 endpoint that decodes, evaluates and re-encodes every RPC - [Spanner](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/spanner.md): The spanner lane: the gRPC endpoint plus GoogleSQL extraction, so operation and table rules read the SQL inside each RPC - [BigQuery](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/bigquery.md): Where the Sidecar fits in front of BigQuery: the Storage API on a grpc lane, and the REST plane's boundaries - [HTTP](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/http.md): What the HTTP codec inspects beyond ext_authz, and how an http lane masks responses - [Kubernetes API](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/kubernetes.md): Put kube-apiserver behind an http lane: read kubectl's headers as a guardrail, mask Secret and ConfigMap data by JSON key, judge bodiless requests with the analyzer, and audit kubectl exec frames - [Overview](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh.md): An SSH server that enforces guardrails, masking and audit on the host itself, with a certificate-verified identity on every command - [Topologies](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/topologies.md): Four ways to deploy an SSH listener: three that enforce at the end of the hop, and one that terminates in the middle - [Bastion SSH Termination](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/bastion-termination.md): A bastion that terminates the jump and relays to a stock sshd, so guardrails, masking and the audit trail apply to a host with nothing installed on it - [Configuration](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/configuration.md): Every attribute an ssh listener takes, the full capability surface it admits, what each one can carry, and what startup refuses - [Certificates and Identity](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/certificates.md): How certificates are used to enforce identity and access, and what fields the Sidecar reads and refuses - [Host Configuration](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/hosts.md): Accounts, groups, login shells and home directories the end-hop needs, and the root vs non-root trade - [File Transfer](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/file-transfer.md): sftp, scp in both of its modes, and rsync — four clients, four different policy surfaces - [OpenSSH Differences](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/limitations.md): How does this protocol compares with the OpenSSH server implementation, and what assumptions to drop - [Known Limitations](https://mintlify.hoop.dev/docs/setup/configuration/hoop-sidecar/protocols/ssh/known-limitations.md): What an ssh lane does not do, stated before you deploy it rather than after - [Direct Access](https://mintlify.hoop.dev/docs/features/direct-access.md): The straight-through path. Guardrails and Data Masking apply inline, with no model in the way. - [Agentic Access](https://mintlify.hoop.dev/docs/features/agentic-access.md): Let a language model classify the statement, and let the risk level pick the tool. - [Data Masking](https://mintlify.hoop.dev/docs/features/data-masking.md): Rewrite sensitive values in the response, in memory, before they reach the client. - [Guardrails](https://mintlify.hoop.dev/docs/features/guardrails.md): An ordered deny list evaluated against every statement, before it reaches the resource. - [Control Plane](https://mintlify.hoop.dev/docs/core-concepts/control-plane.md): The brain of the operation. Centralizes Sidecars and delivers rule sets to all of them. - [Overview](https://mintlify.hoop.dev/docs/control-plane/install.md): Deploy the Control Plane in your own infrastructure with Docker Compose, Kubernetes or AWS. - [Docker Compose](https://mintlify.hoop.dev/docs/control-plane/deployment/docker-compose.md): Stand up a Control Plane on a single host with docker compose. - [Kubernetes](https://mintlify.hoop.dev/docs/control-plane/deployment/kubernetes.md): Deploy the Control Plane with the Helm chart, on any cloud provider. - [Container Images](https://mintlify.hoop.dev/docs/control-plane/container-images.md): The images that run the Control Plane, what each one contains, and when to pick which. - [Environment Variables](https://mintlify.hoop.dev/docs/control-plane/environment-variables.md): Every variable the Control Plane reads, what it does, and what it defaults to. - [Slack](https://mintlify.hoop.dev/docs/control-plane/slack.md): Send held statements to Slack. Reviewers approve there without signing in. - [Get MCP OAuth Authorization Server Metadata](https://mintlify.hoop.dev/docs/api-reference/server-management/get-mcp-oauth-authorization-server-metadata.md): RFC 8414 authorization-server metadata mirroring the configured IdP, with registration_endpoint pointing at the gateway's RFC 7591 registration shim. Served unauthenticated at the gateway root (outside the /api base path) as /.well-known/oauth-authorization-server and /.well-known/openid-configurati… - [HealthCheck](https://mintlify.hoop.dev/docs/api-reference/server-management/healthcheck.md): Reports if the service is working properly - [Register MCP OAuth Client](https://mintlify.hoop.dev/docs/api-reference/server-management/register-mcp-oauth-client.md): RFC 7591 Dynamic Client Registration shim for IdPs without native DCR support: accepts any registration request and answers with the statically pre-registered OAuth client, echoing the caller's client metadata. Served unauthenticated per RFC 7591. Returns 404 unless MCP OAuth is enabled with a stati… - [Get Organization Analytics Mode](https://mintlify.hoop.dev/docs/api-reference/server-management/get-organization-analytics-mode.md): Get the analytics privacy mode of the caller's organization - [Update Organization Analytics Mode](https://mintlify.hoop.dev/docs/api-reference/server-management/update-organization-analytics-mode.md): Update the analytics privacy mode of the caller's organization - [Get Organization Hide Role Info](https://mintlify.hoop.dev/docs/api-reference/server-management/get-organization-hide-role-info.md): Get whether the caller's organization blocks reading connection/role secrets (envvars) through the API - [Update Organization Hide Role Info](https://mintlify.hoop.dev/docs/api-reference/server-management/update-organization-hide-role-info.md): Toggle whether the caller's organization blocks reading connection/role secrets (envvars) through the API - [Update Org License](https://mintlify.hoop.dev/docs/api-reference/server-management/update-org-license.md): Upload a new license into the system - [Sign License](https://mintlify.hoop.dev/docs/api-reference/server-management/sign-license.md): Sign a new license for a customer. This route is for internal use only - [Get Organization Onboarding Status](https://mintlify.hoop.dev/docs/api-reference/server-management/get-organization-onboarding-status.md): Get the setup checklist state for the caller's organization. Each step latches the first time it is satisfied, so a check never reverts. Once every check passes, `show_setup_checklist` on /userinfo turns false — the signal to stop calling this endpoint. - [Get Organization Protection Profile](https://mintlify.hoop.dev/docs/api-reference/server-management/get-organization-protection-profile.md): Get the organization's default protection profile. A null profile means manual configuration. - [Update Organization Protection Profile](https://mintlify.hoop.dev/docs/api-reference/server-management/update-organization-protection-profile.md): Select the organization's default protection profile. The backend materializes the profile's managed rules and attribute and tags every connection. Passing a null profile switches to manual configuration and deletes all Hoop-managed protection rules. - [Get Public Server Info](https://mintlify.hoop.dev/docs/api-reference/server-management/get-public-server-info.md): Get public server information - [Get Authentication Configuration](https://mintlify.hoop.dev/docs/api-reference/server-management/get-authentication-configuration.md): Get authentication configuration - [Update Authentication Configuration](https://mintlify.hoop.dev/docs/api-reference/server-management/update-authentication-configuration.md): Update authentication configuration - [Generate API Key](https://mintlify.hoop.dev/docs/api-reference/server-management/generate-api-key.md): Generate a rollout api key - [Get MCP OAuth 2.1 Resource Server Configuration](https://mintlify.hoop.dev/docs/api-reference/server-management/get-mcp-oauth-21-resource-server-configuration.md): Returns the per-org MCP OAuth Resource Server settings. When disabled (default), /mcp accepts Hoop-issued bearer tokens only. - [Update MCP OAuth 2.1 Resource Server Configuration](https://mintlify.hoop.dev/docs/api-reference/server-management/update-mcp-oauth-21-resource-server-configuration.md): Enable, disable, or reconfigure the OAuth 2.1 Resource Server profile for the /mcp endpoint. - [Get Server Miscellaneous Configuration](https://mintlify.hoop.dev/docs/api-reference/server-management/get-server-miscellaneous-configuration.md): Get server miscellaneous configuration - [Update Server Miscellaneous Configuration](https://mintlify.hoop.dev/docs/api-reference/server-management/update-server-miscellaneous-configuration.md): Update server miscellaneous configuration - [Get Server Info](https://mintlify.hoop.dev/docs/api-reference/server-management/get-server-info.md): Get server information - [List Access Request Rules](https://mintlify.hoop.dev/docs/api-reference/access-request-rules/list-access-request-rules.md): List all access request rules for the organization with pagination - [Create Access Request Rule](https://mintlify.hoop.dev/docs/api-reference/access-request-rules/create-access-request-rule.md): Create a new access request rule for the organization - [Get Access Request Rule](https://mintlify.hoop.dev/docs/api-reference/access-request-rules/get-access-request-rule.md): Get an access request rule by ID - [Update Access Request Rule](https://mintlify.hoop.dev/docs/api-reference/access-request-rules/update-access-request-rule.md): Update an access request rule by ID - [Delete Access Request Rule](https://mintlify.hoop.dev/docs/api-reference/access-request-rules/delete-access-request-rule.md): Delete an access request rule by name - [List Agent Keys](https://mintlify.hoop.dev/docs/api-reference/agents/list-agent-keys.md): List all agent keys - [Create Agent Key](https://mintlify.hoop.dev/docs/api-reference/agents/create-agent-key.md): Create an agent key in a DSN format: `grpc(s)://:@:?mode=standard|embedded`. This key is used to deploy agents and expose internal resources from your infra-structure - [Get Agent Key](https://mintlify.hoop.dev/docs/api-reference/agents/get-agent-key.md): Get an agent key by name or ID - [Delete Agent Key](https://mintlify.hoop.dev/docs/api-reference/agents/delete-agent-key.md): Remove an agent key. It will invalidate a running agent - [List AI Agents](https://mintlify.hoop.dev/docs/api-reference/ai-agents/list-ai-agents.md): List all AI Agents for the organization - [Create AI Agent](https://mintlify.hoop.dev/docs/api-reference/ai-agents/create-ai-agent.md): Generate a new AI Agent. The raw key is returned only once in the response and cannot be retrieved after creation. - [Get AI Agent](https://mintlify.hoop.dev/docs/api-reference/ai-agents/get-ai-agent.md): Get an AI Agent by name or ID - [Update AI Agent](https://mintlify.hoop.dev/docs/api-reference/ai-agents/update-ai-agent.md): Update an AI Agent's name and/or groups. Works for both active and revoked agents. - [Revoke AI Agent](https://mintlify.hoop.dev/docs/api-reference/ai-agents/revoke-ai-agent.md): Revoke an AI Agent (soft delete). The agent status is set to revoked. - [Reactivate AI Agent](https://mintlify.hoop.dev/docs/api-reference/ai-agents/reactivate-ai-agent.md): Reactivate a revoked AI Agent. Sets status back to active and clears deactivation metadata. - [Get AI Session Analyzer Provider](https://mintlify.hoop.dev/docs/api-reference/ai/get-ai-session-analyzer-provider.md): Get the AI provider configured for the session analyzer feature in the organization - [Upsert AI Session Analyzer Provider](https://mintlify.hoop.dev/docs/api-reference/ai/upsert-ai-session-analyzer-provider.md): Create or update the AI provider for the session analyzer feature in the organization (one per org) - [Delete AI Session Analyzer Provider](https://mintlify.hoop.dev/docs/api-reference/ai/delete-ai-session-analyzer-provider.md): Delete the AI provider configured for the session analyzer feature in the organization - [List AI Session Analyzer Rules](https://mintlify.hoop.dev/docs/api-reference/ai/list-ai-session-analyzer-rules.md): List all AI session analyzer rules for the organization, optionally filtered by connection names - [Create AI Session Analyzer Rule](https://mintlify.hoop.dev/docs/api-reference/ai/create-ai-session-analyzer-rule.md): Create a new AI session analyzer rule - [Get AI Session Analyzer Rule](https://mintlify.hoop.dev/docs/api-reference/ai/get-ai-session-analyzer-rule.md): Get an AI session analyzer rule by name - [Update AI Session Analyzer Rule](https://mintlify.hoop.dev/docs/api-reference/ai/update-ai-session-analyzer-rule.md): Update an existing AI session analyzer rule - [Delete AI Session Analyzer Rule](https://mintlify.hoop.dev/docs/api-reference/ai/delete-ai-session-analyzer-rule.md): Delete an AI session analyzer rule - [Get AI Session Analyzer System Prompt](https://mintlify.hoop.dev/docs/api-reference/ai/get-ai-session-analyzer-system-prompt.md): Returns the read-only system prompt that the gateway prepends before any custom_prompt configured on a rule - [Get AI Session Analyzer Rule by Connection](https://mintlify.hoop.dev/docs/api-reference/ai/get-ai-session-analyzer-rule-by-connection.md): Get the AI session analyzer rule configured for a specific connection - [List API Keys](https://mintlify.hoop.dev/docs/api-reference/api-keys/list-api-keys.md): List all API keys for the organization - [Create API Key](https://mintlify.hoop.dev/docs/api-reference/api-keys/create-api-key.md): Generate a new API key. The raw key is returned only once in the response and cannot be retrieved after creation. - [Get API Key](https://mintlify.hoop.dev/docs/api-reference/api-keys/get-api-key.md): Get an API key by name or ID - [Update API Key](https://mintlify.hoop.dev/docs/api-reference/api-keys/update-api-key.md): Update an API key's name and/or groups. Works for both active and revoked keys. - [Revoke API Key](https://mintlify.hoop.dev/docs/api-reference/api-keys/revoke-api-key.md): Revoke an API key (soft delete). The key status is set to revoked. - [Reactivate API Key](https://mintlify.hoop.dev/docs/api-reference/api-keys/reactivate-api-key.md): Reactivate a revoked API key. Sets status back to active and clears deactivation metadata. - [List Attributes](https://mintlify.hoop.dev/docs/api-reference/attributes/list-attributes.md): List attributes for the organization with optional pagination and search. - [Create Attribute](https://mintlify.hoop.dev/docs/api-reference/attributes/create-attribute.md): Create a new attribute for the organization. - [Get Attribute](https://mintlify.hoop.dev/docs/api-reference/attributes/get-attribute.md): Get an attribute by name or ID. - [Update Attribute](https://mintlify.hoop.dev/docs/api-reference/attributes/update-attribute.md): Rename an existing attribute. - [Delete Attribute](https://mintlify.hoop.dev/docs/api-reference/attributes/delete-attribute.md): Delete an attribute by name or ID. - [List security audit logs](https://mintlify.hoop.dev/docs/api-reference/audit-logs/list-security-audit-logs.md): Lists security audit log entries for the organization. Only admins can access this API. Supports filtering by actor, resource type, action, HTTP method, HTTP status, client IP, path, outcome, and date range. Results are ordered by created_at descending. - [OIDC | Login Callback](https://mintlify.hoop.dev/docs/api-reference/authentication/oidc-|-login-callback.md): Exchanges and validates the authorization code for an access token after being redirect by the external provider. A success authentication will redirect the user back to the default redirect url provided in the /login route. - [Local | Login](https://mintlify.hoop.dev/docs/api-reference/authentication/local-|-login.md): Generate a new access token to interact with the API that expires in 12 hours. - [Local | Register User](https://mintlify.hoop.dev/docs/api-reference/authentication/local-|-register-user.md): It registers a new user in the system with the provided email and password. Additionall users are only registered when they are invited by an existing admin user. - [OIDC | Login](https://mintlify.hoop.dev/docs/api-reference/authentication/oidc-|-login.md): Returns the login url to perform the signin on the identity provider - [SAML | Login Callback](https://mintlify.hoop.dev/docs/api-reference/authentication/saml-|-login-callback.md): It redirects the user to the redirect URL with a JWT access token on success. A success authentication will redirect the user back to the default redirect url provided in the /saml/login route. In case of error it will include the query string error= when redirecting. - [SAML | Login](https://mintlify.hoop.dev/docs/api-reference/authentication/saml-|-login.md): Returns the login url to perform the signin on the identity provider. - [OIDC | Signup](https://mintlify.hoop.dev/docs/api-reference/authentication/oidc-|-signup.md): Signup anonymous authenticated user. This endpoint is only used for multi tenant setups. - [List Active Connection Credentials](https://mintlify.hoop.dev/docs/api-reference/connections/list-active-connection-credentials.md): Returns the authenticated user's active (non-revoked, non-expired) credentials, AT MOST ONE PER CONNECTION. Several rows can be live for the same connection — issuing reuses the existing credential while resuming an approved review mints a parallel one — so the list resolves them the same way the re… - [List Connections](https://mintlify.hoop.dev/docs/api-reference/connections/list-connections.md): List all connections. - [Create Connection](https://mintlify.hoop.dev/docs/api-reference/connections/create-connection.md): The connection resource allows exposing internal services from your internal infra structure to users. - [List Connection Tags](https://mintlify.hoop.dev/docs/api-reference/connections/list-connection-tags.md): List all Connection Tags. - [Get Connection](https://mintlify.hoop.dev/docs/api-reference/connections/get-connection.md): Get resource by name or id - [Update Connection](https://mintlify.hoop.dev/docs/api-reference/connections/update-connection.md): Update a connection resource - [Delete Connection](https://mintlify.hoop.dev/docs/api-reference/connections/delete-connection.md): Delete a connection resource. A connection that mirrors a sidecar listener answers 409: remove the listener from the sidecar instead. - [Patch Connection](https://mintlify.hoop.dev/docs/api-reference/connections/patch-connection.md): Partial update of a connection resource. Only provided fields will be updated. - [Get Table Columns](https://mintlify.hoop.dev/docs/api-reference/connections/get-table-columns.md): Get columns from a specific table - [Get Active Connection Credentials](https://mintlify.hoop.dev/docs/api-reference/connections/get-active-connection-credentials.md): Returns the current active, non-expired credentials for the authenticated user on the given connection without creating a new session. Returns 404 if no active credentials exist or they have expired. - [Create Connection Credentials](https://mintlify.hoop.dev/docs/api-reference/connections/create-connection-credentials.md): Create Connection Credentials - [Close Connection Credentials Session](https://mintlify.hoop.dev/docs/api-reference/connections/close-connection-credentials-session.md): Ends the current audit session for a credential and tears down any active proxy connections, but keeps the credential itself usable. The stored token is preserved so the next credential request for the same (user, connection) pair returns the same value. For explicit token invalidation use the revok… - [Revoke Connection Credentials](https://mintlify.hoop.dev/docs/api-reference/connections/revoke-connection-credentials.md): Revokes a connection credential, invalidating the stored token and disconnecting any active sessions. The next credential request for the same (user, connection) pair will issue a fresh token. - [Resume Connection Credentials Request](https://mintlify.hoop.dev/docs/api-reference/connections/resume-connection-credentials-request.md): Resume a connection credentials request after review approval - [List Databases](https://mintlify.hoop.dev/docs/api-reference/connections/list-databases.md): List all available databases for a database connection - [Update Data Masking Rule Connections](https://mintlify.hoop.dev/docs/api-reference/connections/update-data-masking-rule-connections.md): Update Data Masking Rule Connections - [Get Federation Configuration for a Connection](https://mintlify.hoop.dev/docs/api-reference/connections/get-federation-configuration-for-a-connection.md): Returns the IAM federation configuration for a connection. The admin credentials are never returned in plaintext; only a presence indicator is included. - [Upsert Federation Configuration for a Connection](https://mintlify.hoop.dev/docs/api-reference/connections/upsert-federation-configuration-for-a-connection.md): Creates or updates the IAM federation configuration for a connection. AdminCredentialsJSON is write-only; omit on update to preserve the stored value. - [Delete Federation Configuration for a Connection](https://mintlify.hoop.dev/docs/api-reference/connections/delete-federation-configuration-for-a-connection.md): Removes the IAM federation configuration for a connection. Subsequent sessions on this connection revert to the static connection envs. - [List Database Tables](https://mintlify.hoop.dev/docs/api-reference/connections/list-database-tables.md): List tables from a database without column details - [Test Connection](https://mintlify.hoop.dev/docs/api-reference/connections/test-connection.md): Test resource by name or id (only for database connections, it will attempt a simple ping). - [List MCP Server Catalog](https://mintlify.hoop.dev/docs/api-reference/connections/list-mcp-server-catalog.md): List the built-in catalog of publicly hosted remote MCP servers. Used by the connection create page to pre-fill an `mcpproxy` connection's endpoint, transport and auth mode from a picker. - [Start the OAuth login flow for an MCP connection](https://mintlify.hoop.dev/docs/api-reference/connections/start-the-oauth-login-flow-for-an-mcp-connection.md): Discovers the MCP server's authorization server (RFC 9728 / RFC 8414), optionally performs Dynamic Client Registration (RFC 7591) when no client credentials are supplied, and returns the authorization URL for the admin's browser to complete an Authorization Code + PKCE login. The browser is redirect… - [OAuth callback for MCP connection login](https://mintlify.hoop.dev/docs/api-reference/connections/oauth-callback-for-mcp-connection-login.md): The upstream authorization server's redirect target. Validates the state issued by the authorize endpoint, exchanges the authorization code for an access token, stores it on the flow row, and redirects the browser back to the connection create page with mcp_oauth=success|error and the flow_id. This… - [Retrieve the token obtained by an MCP OAuth login](https://mintlify.hoop.dev/docs/api-reference/connections/retrieve-the-token-obtained-by-an-mcp-oauth-login.md): Returns the access token obtained by a completed MCP OAuth login so the connection create page can freeze it into the connection's HEADER_AUTHORIZATION configuration. The token is returned at most once: the flow row is deleted on read. - [Report the user's per-user federation connection status](https://mintlify.hoop.dev/docs/api-reference/federation/report-the-users-per-user-federation-connection-status.md): Reports, for the authenticated user, whether they have connected a per-user account (e.g. their Google account for gcp_oauth) to a connection. Clients use this to decide whether to prompt the user to connect before running. Access is scoped to connections the user is allowed to run. - [Disconnect a user's Google account from a connection](https://mintlify.hoop.dev/docs/api-reference/federation/disconnect-a-users-google-account-from-a-connection.md): Deletes the authenticated user's stored Google refresh token for a gcp_oauth-federated connection. Subsequent sessions fail until the user re-consents. - [Start the Google OAuth consent flow for a connection](https://mintlify.hoop.dev/docs/api-reference/federation/start-the-google-oauth-consent-flow-for-a-connection.md): Returns the Google consent URL for the authenticated user to connect their Google account to a gcp_oauth-federated connection. The browser should be redirected to the returned URL; Google redirects back to the gateway callback, which stores the resulting refresh token. - [Google OAuth callback for connection federation](https://mintlify.hoop.dev/docs/api-reference/federation/google-oauth-callback-for-connection-federation.md): Google's OAuth redirect target. Validates the state issued by the authorize endpoint, exchanges the authorization code for a refresh token, stores it for the user/connection, and redirects the browser back to the application with federation_oauth=success|error. This endpoint is unauthenticated but s… - [Test a Federation Configuration End-to-End](https://mintlify.hoop.dev/docs/api-reference/federation/test-a-federation-configuration-end-to-end.md): Resolves the candidate federation configuration against a synthetic user AND dispatches a one-shot smoke probe (the caller-supplied test_script, e.g. "SELECT 1") to the agent identified in the request body. Persisted state is never read or written: the entire candidate connection + federation pair l… - [List Data Masking Rules](https://mintlify.hoop.dev/docs/api-reference/data-masking-rules/list-data-masking-rules.md): List Data Masking Rules - [Create Data Masking Rule](https://mintlify.hoop.dev/docs/api-reference/data-masking-rules/create-data-masking-rule.md): Create Data Masking Rule - [Get Data Masking Rule](https://mintlify.hoop.dev/docs/api-reference/data-masking-rules/get-data-masking-rule.md): Get Data Masking Rule - [Update Data Masking Rule](https://mintlify.hoop.dev/docs/api-reference/data-masking-rules/update-data-masking-rule.md): Update Data Masking Rule - [Delete Data Masking Rule](https://mintlify.hoop.dev/docs/api-reference/data-masking-rules/delete-data-masking-rule.md): Delete a Data Masking Rule resource. - [List DB Role Jobs](https://mintlify.hoop.dev/docs/api-reference/aws/list-db-role-jobs.md): List all db role jobs - [Create Database Role Job](https://mintlify.hoop.dev/docs/api-reference/aws/create-database-role-job.md): It creates a job that performs the provisioning of default database roles - [Get DB Role Job](https://mintlify.hoop.dev/docs/api-reference/aws/get-db-role-job.md): Get DB Role job by id - [Update IAM Access Key](https://mintlify.hoop.dev/docs/api-reference/aws/update-iam-access-key.md): Update IAM Access Key or set a region when using IAM instance role - [Delete IAM Access Key](https://mintlify.hoop.dev/docs/api-reference/aws/delete-iam-access-key.md): Remove IAM Access Key from memory - [Get Caller Identity](https://mintlify.hoop.dev/docs/api-reference/aws/get-caller-identity.md): It obtain the aws identity of the instance role or credentials - [List AWS Accounts](https://mintlify.hoop.dev/docs/api-reference/aws/list-aws-accounts.md): It list all AWS accounts associated with the access key credentials - [Create RDS Root Password](https://mintlify.hoop.dev/docs/api-reference/aws/create-rds-root-password.md): It creates password for RDS instances that is used to reset the root password when executing the database role job. The password are used only once and expire after 30 minutes. - [List Database Instances](https://mintlify.hoop.dev/docs/api-reference/aws/list-database-instances.md): It list RDS Database Instances - [List Feature Flags](https://mintlify.hoop.dev/docs/api-reference/feature-flags/list-feature-flags.md): List all feature flags from the catalog with their per-org state - [Update Feature Flag](https://mintlify.hoop.dev/docs/api-reference/feature-flags/update-feature-flag.md): Enable or disable a feature flag for the organization - [OpenAI Chat Completions](https://mintlify.hoop.dev/docs/api-reference/features/openai-chat-completions.md): Proxy to OpenAI chat completions `/vi/chat/completions` - [Feature Update](https://mintlify.hoop.dev/docs/api-reference/features/feature-update.md): Updates a feature configuration. It will report if this feature is available in the user info endpoint. - [Get Webhooks Dashboard](https://mintlify.hoop.dev/docs/api-reference/features/get-webhooks-dashboard.md): Get webhooks dashboard url - [List Guard Rail Rules](https://mintlify.hoop.dev/docs/api-reference/guard-rails/list-guard-rail-rules.md): List Guard Rail Rules - [Create Guard Rail Rules](https://mintlify.hoop.dev/docs/api-reference/guard-rails/create-guard-rail-rules.md): Create Guard Rail Rules - [Get Guard Rail Rules](https://mintlify.hoop.dev/docs/api-reference/guard-rails/get-guard-rail-rules.md): Get Guard Rail Rules - [Update Guard Rail Rules](https://mintlify.hoop.dev/docs/api-reference/guard-rails/update-guard-rail-rules.md): Update Guard Rail Rules - [Delete a Rule](https://mintlify.hoop.dev/docs/api-reference/guard-rails/delete-a-rule.md): Delete a Guard Rail Rule resource. - [Get Jira Integration](https://mintlify.hoop.dev/docs/api-reference/jira/get-jira-integration.md): Get Jira integration for the organization - [Update Jira Integration](https://mintlify.hoop.dev/docs/api-reference/jira/update-jira-integration.md): Update the Jira integration for the organization - [Create Jira Integration](https://mintlify.hoop.dev/docs/api-reference/jira/create-jira-integration.md): Create a new Jira integration for the organization - [Get Asset Field Configurations](https://mintlify.hoop.dev/docs/api-reference/jira/get-asset-field-configurations.md): Get the AQL configuration of Jira Service Management (JSM) Assets custom fields. These are the object scope and dependent-field (issue scope) filters Jira's own portal applies; they drive the CMDB dropdown cascade. Fields without any configured filter are omitted. - [Get Asset Objects](https://mintlify.hoop.dev/docs/api-reference/jira/get-asset-objects.md): Get objects from the Jira Service Management (JSM) Assets API - [List Issue Templates](https://mintlify.hoop.dev/docs/api-reference/jira/list-issue-templates.md): List Issue Templates - [Create Issue Templates](https://mintlify.hoop.dev/docs/api-reference/jira/create-issue-templates.md): Create Issue Templates - [Get Issue Templates](https://mintlify.hoop.dev/docs/api-reference/jira/get-issue-templates.md): Get Issue Templates - [Update Issue Templates](https://mintlify.hoop.dev/docs/api-reference/jira/update-issue-templates.md): Update Issue Templates - [Delete Issue Templates](https://mintlify.hoop.dev/docs/api-reference/jira/delete-issue-templates.md): Delete Issue Templates - [List Machine Identities](https://mintlify.hoop.dev/docs/api-reference/machine-identities/list-machine-identities.md): List all machine identities (non-human identities) - [Create Machine Identity](https://mintlify.hoop.dev/docs/api-reference/machine-identities/create-machine-identity.md): Create a machine identity (non-human identity) with native credentials for each connection - [Get Machine Identity](https://mintlify.hoop.dev/docs/api-reference/machine-identities/get-machine-identity.md): Get a machine identity by name - [Update Machine Identity](https://mintlify.hoop.dev/docs/api-reference/machine-identities/update-machine-identity.md): Update a machine identity. Adding connections provisions new credentials; removing connections revokes them. - [Delete Machine Identity](https://mintlify.hoop.dev/docs/api-reference/machine-identities/delete-machine-identity.md): Delete a machine identity and revoke all associated credentials - [List Machine Identity Credentials](https://mintlify.hoop.dev/docs/api-reference/machine-identities/list-machine-identity-credentials.md): List full credential details for a machine identity including connection strings and secret keys - [Rotate Machine Identity Credential](https://mintlify.hoop.dev/docs/api-reference/machine-identities/rotate-machine-identity-credential.md): Rotate (regenerate) a credential for a specific connection. The old credential is revoked and a new one is returned. - [Get Session Metrics](https://mintlify.hoop.dev/docs/api-reference/session-metrics/get-session-metrics.md): Query session metrics data with advanced filtering. Supports AND/OR logic for combining filters. Filter by resource types (connection_type), resource subtypes (connection_subtype), resources (connection_name), Presidio data types (info_type), masked/unmasked status, date ranges, session dates, and s… - [Handle Organization Invitation](https://mintlify.hoop.dev/docs/api-reference/user-management/handle-organization-invitation.md): Accept or decline a pending organization invitation. On accept, the current user is migrated to the invited org and the old auto-created org is removed if empty. On decline, the invitation is dismissed permanently. - [List Service Accounts](https://mintlify.hoop.dev/docs/api-reference/user-management/list-service-accounts.md): List all service accounts - [Create Service Account](https://mintlify.hoop.dev/docs/api-reference/user-management/create-service-account.md): Create a service account that is associated with a identity provider client - [Update Service Account](https://mintlify.hoop.dev/docs/api-reference/user-management/update-service-account.md): Update a service account that is associated with a identity provider client - [Get UserInfo](https://mintlify.hoop.dev/docs/api-reference/user-management/get-userinfo.md): Get own user's information - [List Users](https://mintlify.hoop.dev/docs/api-reference/user-management/list-users.md): List all users - [Create User](https://mintlify.hoop.dev/docs/api-reference/user-management/create-user.md): Creating a user will pre configure user definitions like display name, profile picture, groups and the slack id - [List User Groups](https://mintlify.hoop.dev/docs/api-reference/user-management/list-user-groups.md): List every group name known to the organization: the ones bound to users, service accounts, API keys and AI agents, plus the ones referenced by the access_control plugin. Sorted alphabetically. - [Create User Group](https://mintlify.hoop.dev/docs/api-reference/user-management/create-user-group.md): Create a new user group - [Delete User Group](https://mintlify.hoop.dev/docs/api-reference/user-management/delete-user-group.md): Delete a user group - [Answer Signup Origin Survey](https://mintlify.hoop.dev/docs/api-reference/user-management/answer-signup-origin-survey.md): Record how the authenticated user heard about Hoop. Each user may answer only once; a second attempt returns 409. - [Patch User Slack ID](https://mintlify.hoop.dev/docs/api-reference/user-management/patch-user-slack-id.md): Patch own user's slack id - [Get User](https://mintlify.hoop.dev/docs/api-reference/user-management/get-user.md): Get user by email or subject id - [Update User](https://mintlify.hoop.dev/docs/api-reference/user-management/update-user.md): Updates an existing user - [Delete User](https://mintlify.hoop.dev/docs/api-reference/user-management/delete-user.md): Delete a user. - [Get Org Key](https://mintlify.hoop.dev/docs/api-reference/organization-management/get-org-key.md): Get the organization key to run with `hoop run` command line - [Create Org Key](https://mintlify.hoop.dev/docs/api-reference/organization-management/create-org-key.md): Create the organization key to run with `hoop run` command line. - [Revoke Org Key](https://mintlify.hoop.dev/docs/api-reference/organization-management/revoke-org-key.md): Remove organization key - [List Plugins](https://mintlify.hoop.dev/docs/api-reference/plugins/list-plugins.md): List all Plugin resources - [Create Plugin](https://mintlify.hoop.dev/docs/api-reference/plugins/create-plugin.md): Create Plugin resource - [Get Plugin](https://mintlify.hoop.dev/docs/api-reference/plugins/get-plugin.md): Get a plugin resource by name - [Update Plugin](https://mintlify.hoop.dev/docs/api-reference/plugins/update-plugin.md): Update Plugin resource. The `config` and `name` attributes are immutable for this endpoint. - [Update Plugin Config](https://mintlify.hoop.dev/docs/api-reference/plugins/update-plugin-config.md): Update the Plugin resource top level configuration. - [Get Plugin Connection](https://mintlify.hoop.dev/docs/api-reference/plugins/get-plugin-connection.md): Get a plugin connection resource - [Upsert Plugin Connection](https://mintlify.hoop.dev/docs/api-reference/plugins/upsert-plugin-connection.md): Update or create a plugin connection resource - [Delete Plugin Connection](https://mintlify.hoop.dev/docs/api-reference/plugins/delete-plugin-connection.md): Delete a plugin connection resource. - [Runbook Exec](https://mintlify.hoop.dev/docs/api-reference/runbooks/runbook-exec.md): Start a execution using a Runbook as input. If the connection has a JIRA issue template configured, it will create a JIRA issue. - [List Runbooks By Connection](https://mintlify.hoop.dev/docs/api-reference/runbooks/list-runbooks-by-connection.md): List Runbooks templates by connection - [List Runbooks](https://mintlify.hoop.dev/docs/api-reference/runbooks/list-runbooks.md): List all Runbooks - [List Runbooks](https://mintlify.hoop.dev/docs/api-reference/runbooks/list-runbooks-1.md): List all Runbooks - [Get Runbook Configuration](https://mintlify.hoop.dev/docs/api-reference/runbooks/get-runbook-configuration.md): Get Runbook Configuration - [Update Runbook Configuration](https://mintlify.hoop.dev/docs/api-reference/runbooks/update-runbook-configuration.md): Update Runbook Configuration - [Create Runbook Configuration Entry](https://mintlify.hoop.dev/docs/api-reference/runbooks/create-runbook-configuration-entry.md): Create Runbook Configuration Entry - [Update Runbook Configuration Entry](https://mintlify.hoop.dev/docs/api-reference/runbooks/update-runbook-configuration-entry.md): Update Runbook Configuration Entry - [Delete Runbook Configuration Entry](https://mintlify.hoop.dev/docs/api-reference/runbooks/delete-runbook-configuration-entry.md): Delete a runbook configuration entry. - [Create Runbook File](https://mintlify.hoop.dev/docs/api-reference/runbooks/create-runbook-file.md): Commit a new file (or overwrite an existing one) to the git repository associated with the given configuration ID. - [Runbook Exec](https://mintlify.hoop.dev/docs/api-reference/runbooks/runbook-exec-1.md): Start a execution using a Runbook as input. If the connection has a JIRA issue template configured, it will create a JIRA issue. - [List Runbook Rules](https://mintlify.hoop.dev/docs/api-reference/runbooks/list-runbook-rules.md): List all Runbook Rules - [Create Runbook Rule](https://mintlify.hoop.dev/docs/api-reference/runbooks/create-runbook-rule.md): Create a new Runbook Rule - [Get Runbook Rule](https://mintlify.hoop.dev/docs/api-reference/runbooks/get-runbook-rule.md): Get a single Runbook Rule by ID - [Update Runbook Rule](https://mintlify.hoop.dev/docs/api-reference/runbooks/update-runbook-rule.md): Update an existing Runbook Rule by ID - [Delete Runbook Rule](https://mintlify.hoop.dev/docs/api-reference/runbooks/delete-runbook-rule.md): Delete a Runbook Rule by ID - [ProxyManager Connect](https://mintlify.hoop.dev/docs/api-reference/proxy-manager/proxymanager-connect.md): Send a connect request to the client. A successful response indicates the client has stablished a connection. If the connection resource has the review enabled, it returns a successful response containing the link of the review in the `Localtion` header. - [ProxyManager Disconnect](https://mintlify.hoop.dev/docs/api-reference/proxy-manager/proxymanager-disconnect.md): Send a disconnect request. The transport layer will disconnect the connected client asynchronously - [ProxyManager Status](https://mintlify.hoop.dev/docs/api-reference/proxy-manager/proxymanager-status.md): Get the current status of the client - [Get Compliance Report](https://mintlify.hoop.dev/docs/api-reference/reports/get-compliance-report.md): Computes the compliance report with an overall score, category summaries, actionable items and per-framework control evaluations. - [Session Reports](https://mintlify.hoop.dev/docs/api-reference/reports/session-reports.md): The report payload groups sessions by info types and by a custom field (`group_by`) provided by the client. The items returns data containing the sum of redact fields performed by a given info type aggregated by the `group_by` attribute. - [Lists resources](https://mintlify.hoop.dev/docs/api-reference/resources/lists-resources.md): Lists all resources for the organization. - [Creates a resource](https://mintlify.hoop.dev/docs/api-reference/resources/creates-a-resource.md): Creates a resource for the organization. - [Applies a batch of resource plans](https://mintlify.hoop.dev/docs/api-reference/resources/applies-a-batch-of-resource-plans.md): Applies a batch of previously created resource plans. Each item references a plan session by SID and the target resource name. All items are processed concurrently and the response is returned once all have completed. Per-item failures are embedded in the results with status "failed" rather than ret… - [Tests connectivity for multiple resources](https://mintlify.hoop.dev/docs/api-reference/resources/tests-connectivity-for-multiple-resources.md): Performs concurrent connectivity tests for the given resources. Each execution has a 10-second timeout. - [Creates a batch of resource plans](https://mintlify.hoop.dev/docs/api-reference/resources/creates-a-batch-of-resource-plans.md): Validates provisioning plans for a batch of resources by computing the diff between the desired and current role state for each resource. Each item is session-audited and receives its own plan ID (SID) that can be referenced when applying. All items are processed concurrently and the response is ret… - [Gets a resource](https://mintlify.hoop.dev/docs/api-reference/resources/gets-a-resource.md): Gets a resource by ID for the organization. - [Updates a resource](https://mintlify.hoop.dev/docs/api-reference/resources/updates-a-resource.md): Updates a resource by ID for the organization. - [Deletes a resource](https://mintlify.hoop.dev/docs/api-reference/resources/deletes-a-resource.md): Deletes a resource by ID for the organization. - [Applies a resource plan](https://mintlify.hoop.dev/docs/api-reference/resources/applies-a-resource-plan.md): Applies a previously created provisioning plan to a single resource. The plan session referenced by SID must have been created by the plan endpoint. On success, the resulting role and its credentials are synced as a connection. - [Tests connectivity for a resource](https://mintlify.hoop.dev/docs/api-reference/resources/tests-connectivity-for-a-resource.md): Performs a connectivity test against the resource's master credentials to verify network connectivity. Uses a minimal query (e.g. SELECT 1) to confirm the host is reachable and the master user can authenticate. - [Creates a resource plan](https://mintlify.hoop.dev/docs/api-reference/resources/creates-a-resource-plan.md): Validates a provisioning plan for a single resource by computing the diff between the desired and current role state. The plan is session-audited and returns a plan ID (SID) that can be referenced when applying. - [Get Review List,](https://mintlify.hoop.dev/docs/api-reference/reviews/get-review-list.md): Get all reviews resource - [Get Review](https://mintlify.hoop.dev/docs/api-reference/reviews/get-review.md): Get review resource by the id or session id - [Update Review Status](https://mintlify.hoop.dev/docs/api-reference/reviews/update-review-status.md): Update the status of a review resource by its resource ID or session ID. This endpoint is used to approve, reject, or revoke reviews for session execution requests. - [Update Review Status By Sid](https://mintlify.hoop.dev/docs/api-reference/reviews/update-review-status-by-sid.md): Update the status of a review resource by its resource ID or session ID. This endpoint is used to approve, reject, or revoke reviews for session execution requests. - [List Rulepacks](https://mintlify.hoop.dev/docs/api-reference/rulepacks/list-rulepacks.md): List rulepacks for the organization with optional pagination and search. - [Get Rulepack](https://mintlify.hoop.dev/docs/api-reference/rulepacks/get-rulepack.md): Get a rulepack by its UUID. - [Apply Rulepack to Connections](https://mintlify.hoop.dev/docs/api-reference/rulepacks/apply-rulepack-to-connections.md): Replace the set of connections this rulepack is applied to. After the call, the rulepack is attached to exactly the supplied connections (additions and removals as needed). Non-rulepack attributes on each affected connection are preserved. Pass an empty array to remove the rulepack from all connecti… - [Search](https://mintlify.hoop.dev/docs/api-reference/search/search.md): Performs a search for connections and runbooks based on the provided criteria. - [List Server Logs](https://mintlify.hoop.dev/docs/api-reference/server-logs/list-server-logs.md): Tail of recent in-memory runtime logs from the gateway process and connected agents - [Stream Server Logs](https://mintlify.hoop.dev/docs/api-reference/server-logs/stream-server-logs.md): Streams gateway and agent runtime logs in real-time via SSE. Sends a backlog of recent entries on connect, then each new entry as it is captured. - [List Sessions](https://mintlify.hoop.dev/docs/api-reference/sessions/list-sessions.md): List session resources - [Exec](https://mintlify.hoop.dev/docs/api-reference/sessions/exec.md): This endpoint performs ad-hoc executions. It will wait 50 seconds for a sucessful response (200), otherwise return an Accepted status code (202) meaning the execution will be held asynchronously. The outcome could be obtained later on by fetching the resource using the attribute `id`. - [Create a provisioned session using API Key](https://mintlify.hoop.dev/docs/api-reference/sessions/create-a-provisioned-session-using-api-key.md) - [Retry RDP PII analysis](https://mintlify.hoop.dev/docs/api-reference/sessions/retry-rdp-pii-analysis.md): Resets a failed RDP analysis job to pending so the worker pool can re-claim it. - [Get Session](https://mintlify.hoop.dev/docs/api-reference/sessions/get-session.md): Get a session by id. This endpoint returns a conditional response - [Download Session](https://mintlify.hoop.dev/docs/api-reference/sessions/download-session.md): Download session by id - [Download Session Input Command](https://mintlify.hoop.dev/docs/api-reference/sessions/download-session-input-command.md): Download session input session by id - [Reviewed Exec](https://mintlify.hoop.dev/docs/api-reference/sessions/reviewed-exec.md): Run an execution in a reviewed session - [Kill Session](https://mintlify.hoop.dev/docs/api-reference/sessions/kill-session.md) - [Update Session Metadata](https://mintlify.hoop.dev/docs/api-reference/sessions/update-session-metadata.md) - [Get RDP session PII detections](https://mintlify.hoop.dev/docs/api-reference/sessions/get-rdp-session-pii-detections.md): Returns PII entity detections with screen-space coordinates for an RDP session recording - [Get RDP session frames](https://mintlify.hoop.dev/docs/api-reference/sessions/get-rdp-session-frames.md): Returns paginated bitmap frames from an RDP session recording - [Stream Session Result](https://mintlify.hoop.dev/docs/api-reference/sessions/stream-session-result.md): Returns the decoded output of a session as plain text with chunked transfer encoding - [Stream Session Events](https://mintlify.hoop.dev/docs/api-reference/sessions/stream-session-events.md): Streams audit events for an open session in real-time via SSE. Each event is published as it is appended to the WAL. No catch-up is sent for events that occurred before the subscription. - [List Sidecar Deleted Names](https://mintlify.hoop.dev/docs/api-reference/sidecars/list-sidecar-deleted-names.md): List the names of deleted sidecars a service account identity had reached. A token that renders one of them is refused and creates nothing. - [Clear Sidecar Deleted Name](https://mintlify.hoop.dev/docs/api-reference/sidecars/clear-sidecar-deleted-name.md): Allow a service account identity to create a sidecar with this name again, on its next handshake. - [List Sidecar Service Accounts](https://mintlify.hoop.dev/docs/api-reference/sidecars/list-sidecar-service-accounts.md): List the service accounts whose tokens may authenticate a sidecar in the organization. - [Create Sidecar Service Account](https://mintlify.hoop.dev/docs/api-reference/sidecars/create-sidecar-service-account.md): Allow the tokens of a Kubernetes or Google service account to authenticate a sidecar with the hoop-sidecar-identity header. A matching token reaches the sidecar name_template renders, and creates it on its first handshake when no sidecar has that name. The sidecar is bound to the first identity that… - [Get Sidecar Service Account](https://mintlify.hoop.dev/docs/api-reference/sidecars/get-sidecar-service-account.md): Get one sidecar service account by its ID. - [Update Sidecar Service Account](https://mintlify.hoop.dev/docs/api-reference/sidecars/update-sidecar-service-account.md): Replace a sidecar service account. The sidecars it reached keep their names; a token it no longer matches stops authenticating. 409 when another organization uses the new issuer and audience. - [Delete Sidecar Service Account](https://mintlify.hoop.dev/docs/api-reference/sidecars/delete-sidecar-service-account.md): Remove a sidecar service account. The sidecars it reached stay; their tokens stop authenticating unless another sidecar service account allows them. - [List Sidecars](https://mintlify.hoop.dev/docs/api-reference/sidecars/list-sidecars.md): List all sidecars for the organization - [Create Sidecar](https://mintlify.hoop.dev/docs/api-reference/sidecars/create-sidecar.md): Register a sidecar. The token is returned only once in this response and cannot be recovered. - [Sidecar Configuration](https://mintlify.hoop.dev/docs/api-reference/sidecars/sidecar-configuration.md): Authenticated with the hoop-sidecar-token or the hoop-sidecar-identity header, never both. Returns the configuration the sidecar must serve, carrying the organization's license in its "license" key, or only the load_from_disk flag and the license when the sidecar loads its configuration from disk. U… - [Import Sidecar Configuration](https://mintlify.hoop.dev/docs/api-reference/sidecars/import-sidecar-configuration.md): Authenticated with the hoop-sidecar-token or the hoop-sidecar-identity header, never both. Stores the config document a sidecar carried locally, once. Each guardrail and mask rule of the file becomes a rule item, and each listener analyzer block an analyzer rule, bound to the listeners that ran it.… - [Record Sidecar Session Events](https://mintlify.hoop.dev/docs/api-reference/sidecars/record-sidecar-session-events.md): Record a sidecar's audit events as sessions. The sidecar is taken from the token, never the body, and every session it writes is its own. 2xx means the batch is applied, now or by an earlier request: an event at or below its session's last applied seq is ignored. 4xx means the sidecar must not resen… - [Sidecar Handshake](https://mintlify.hoop.dev/docs/api-reference/sidecars/sidecar-handshake.md): Authenticated with the hoop-sidecar-token or the hoop-sidecar-identity header, never both. Records the reported version and returns the configuration the sidecar must serve. A sidecar whose stored configuration sets load_from_disk receives only that flag and its license, and runs its own config file… - [List Sidecar Reviews](https://mintlify.hoop.dev/docs/api-reference/sidecars/list-sidecar-reviews.md): List the reviews the calling sidecar filed, newest first. It never changes a review. - [Create Sidecar Review](https://mintlify.hoop.dev/docs/api-reference/sidecars/create-sidecar-review.md): Register a review for a statement a sidecar held. The sidecar is taken from the token, never the body. A review of the same bytes past its deadline is expired and a new one is filed. - [Get Sidecar Review Status](https://mintlify.hoop.dev/docs/api-reference/sidecars/get-sidecar-review-status.md): Read the status of one review the calling sidecar filed. It never changes the review: an approved review stays approved until the sidecar resends the statement or its approval expires. A review past its deadline reads EXPIRED. - [Claim Sidecar Review](https://mintlify.hoop.dev/docs/api-reference/sidecars/claim-sidecar-review.md): Answer a sidecar waiting on one review it filed. An approved review is consumed once and releases the statement; a review past its deadline is expired and never releases it; any other status is returned as it stands. It never files a review. - [Get Sidecar](https://mintlify.hoop.dev/docs/api-reference/sidecars/get-sidecar.md): Get a sidecar by name or ID - [Update Sidecar](https://mintlify.hoop.dev/docs/api-reference/sidecars/update-sidecar.md): Replace the configuration a sidecar serves. The sidecar picks it up on its next heartbeat. A change of load_from_disk is refused: use PATCH. - [Delete Sidecar](https://mintlify.hoop.dev/docs/api-reference/sidecars/delete-sidecar.md): Delete a sidecar. The token stops working immediately. A sidecar a service account identity reached has its name recorded, so the identity does not create it again; clear it with DELETE /sidecar-deleted-names/{name}. - [Patch Sidecar Configuration](https://mintlify.hoop.dev/docs/api-reference/sidecars/patch-sidecar-configuration.md): Merge a partial configuration into the document a sidecar serves: the keys sent are updated and the rest are left as stored. Unlike PUT it never replaces the whole document, so it cannot overwrite a configuration a sidecar imported meanwhile. load_from_disk true deletes the rules imported from this… - [Clear Sidecar Identity](https://mintlify.hoop.dev/docs/api-reference/sidecars/clear-sidecar-identity.md): Remove the binding of a sidecar to the service account identity that reached it first. The next identity a sidecar service account allows is bound to it on its next handshake; a sidecar created with a token is bound again only through a sidecar service account with adopt_existing_sidecars. A token t… - [Get Sidecar Slack Channels](https://mintlify.hoop.dev/docs/api-reference/sidecars/get-sidecar-slack-channels.md): Where the reviews of each listener of the sidecar are posted in Slack. Control plane only. - [Set Sidecar Slack Channels](https://mintlify.hoop.dev/docs/api-reference/sidecars/set-sidecar-slack-channels.md): Set where the reviews of the listeners in the body are posted in Slack. A listener with no channels uses the fallback channel; a listener left out keeps its channels. Control plane only. - [List SPIFFE Mappings](https://mintlify.hoop.dev/docs/api-reference/spiffe/list-spiffe-mappings.md): List all SPIFFE-ID to agent mappings in the caller's organization. - [Create SPIFFE Mapping](https://mintlify.hoop.dev/docs/api-reference/spiffe/create-spiffe-mapping.md): Map a SPIFFE identity (exact URI or URI prefix) onto a Hoop agent. - [Update SPIFFE Mapping](https://mintlify.hoop.dev/docs/api-reference/spiffe/update-spiffe-mapping.md): Update an existing SPIFFE-ID to agent mapping. - [Delete SPIFFE Mapping](https://mintlify.hoop.dev/docs/api-reference/spiffe/delete-spiffe-mapping.md): Remove a SPIFFE-ID to agent mapping. ## OpenAPI Specs - [openapiv3](https://use.hoop.dev/api/openapiv3.json) ## Optional - [Community](https://github.com/hoophq/hoop/discussions) - [Blog](https://hoop.dev/blog) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.