Create Guard Rail Rules
curl --request POST \
--url https://use.hoop.dev/api/guardrails \
--header 'Content-Type: application/json' \
--data '
{
"name": "my-strict-rule",
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
'import requests
url = "https://use.hoop.dev/api/guardrails"
payload = {
"name": "my-strict-rule",
"attributes": ["production", "pii"],
"connection_ids": ["15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7", "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'my-strict-rule',
attributes: ['production', 'pii'],
connection_ids: ['15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7', '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'],
description: 'description about this rule',
input: {},
output: {},
sidecar_spec: {},
sidecar_targets: [{listener_name: 'appdb', sidecar_id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'}]
})
};
fetch('https://use.hoop.dev/api/guardrails', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/guardrails",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'my-strict-rule',
'attributes' => [
'production',
'pii'
],
'connection_ids' => [
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'
],
'description' => 'description about this rule',
'input' => [
],
'output' => [
],
'sidecar_spec' => [
],
'sidecar_targets' => [
[
'listener_name' => 'appdb',
'sidecar_id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/guardrails"
payload := strings.NewReader("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://use.hoop.dev/api/guardrails")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/guardrails")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"created_at": "2024-07-25T15:56:35.317601Z",
"description": "description about this rule",
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"input": {},
"managed_by": "hoop",
"name": "my-strict-rule",
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
],
"updated_at": "2024-07-25T15:56:35.317601Z"
}{
"message": "the error description"
}{
"message": "the error description"
}{
"message": "the error description"
}Guard Rails
Create Guard Rail Rules
Create Guard Rail Rules
POST
/
guardrails
Create Guard Rail Rules
curl --request POST \
--url https://use.hoop.dev/api/guardrails \
--header 'Content-Type: application/json' \
--data '
{
"name": "my-strict-rule",
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
'import requests
url = "https://use.hoop.dev/api/guardrails"
payload = {
"name": "my-strict-rule",
"attributes": ["production", "pii"],
"connection_ids": ["15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7", "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"],
"description": "description about this rule",
"input": {},
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'my-strict-rule',
attributes: ['production', 'pii'],
connection_ids: ['15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7', '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'],
description: 'description about this rule',
input: {},
output: {},
sidecar_spec: {},
sidecar_targets: [{listener_name: 'appdb', sidecar_id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'}]
})
};
fetch('https://use.hoop.dev/api/guardrails', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/guardrails",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'my-strict-rule',
'attributes' => [
'production',
'pii'
],
'connection_ids' => [
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8'
],
'description' => 'description about this rule',
'input' => [
],
'output' => [
],
'sidecar_spec' => [
],
'sidecar_targets' => [
[
'listener_name' => 'appdb',
'sidecar_id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/guardrails"
payload := strings.NewReader("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://use.hoop.dev/api/guardrails")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/guardrails")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"my-strict-rule\",\n \"attributes\": [\n \"production\",\n \"pii\"\n ],\n \"connection_ids\": [\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8\"\n ],\n \"description\": \"description about this rule\",\n \"input\": {},\n \"output\": {},\n \"sidecar_spec\": {},\n \"sidecar_targets\": [\n {\n \"listener_name\": \"appdb\",\n \"sidecar_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"attributes": [
"production",
"pii"
],
"connection_ids": [
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8"
],
"created_at": "2024-07-25T15:56:35.317601Z",
"description": "description about this rule",
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"input": {},
"managed_by": "hoop",
"name": "my-strict-rule",
"output": {},
"sidecar_spec": {},
"sidecar_targets": [
{
"listener_name": "appdb",
"sidecar_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
}
],
"updated_at": "2024-07-25T15:56:35.317601Z"
}{
"message": "the error description"
}{
"message": "the error description"
}{
"message": "the error description"
}Body
application/json
The request body resource
Unique name for the rule
Example:
"my-strict-rule"
Attributes associated with this guardrail rule
Example:
["production", "pii"]
List of connection IDs that this guardrail applies to
Example:
[ "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7", "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8" ]
The rule description
Example:
"description about this rule"
The input rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{ "name": "deny-select", "description": "<optional-description>", "input": { "rules": [ {"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "message": "<optional-message>"} ] }, "output": { "rules": [ {"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"} ] } }
Show child attributes
Show child attributes
The output rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{ "name": "deny-select", "description": "<optional-description>", "input": { "rules": [ {"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "message": "<optional-message>"} ] }, "output": { "rules": [ {"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"} ] } }
Show child attributes
Show child attributes
SidecarSpec is this rule in the SIDECAR's own vocabulary, which the
gateway's fields above do not share: seven rule types, an operations scope on every one of them,
and action: defer to hand the verdict to a Rego policy. It holds the
guardrails block the listener receives: {"rules": [...]}.
A control plane field. A gateway has no sidecars and refuses it.
SidecarTargets names the sidecar LISTENERS that must enforce this rule, which is how a control plane distributes it to a fleet. A listener, not a sidecar: the listener carries the protocol, and the protocol decides which rule types it can run at all.
A POINTER because absent and empty are different instructions: absent leaves the bindings exactly as they are, and [] unbinds the rule from every sidecar. Without that distinction any write that did not mention the field -- a script fixing a typo, the gateway's own UI, an MCP call -- would silently unbind a rule from the whole fleet.
Show child attributes
Show child attributes
Response
Created
Attributes associated with this guardrail rule
Example:
["production", "pii"]
List of connection IDs that this guardrail applies to
Example:
[ "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7", "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D8" ]
The time the resource was created
Example:
"2024-07-25T15:56:35.317601Z"
The rule description
Example:
"description about this rule"
The resource identifier
Example:
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
The input rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{ "name": "deny-select", "description": "<optional-description>", "input": { "rules": [ {"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "name": "<optional-name>", "message": "<optional-message>"} ] }, "output": { "rules": [ {"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"} ] } }
Show child attributes
Show child attributes
Set to "hoop" when the rule is materialized and lifecycle-managed by a protection profile; managed rules are read-only through this API
Example:
"hoop"
Unique name for the rule
Example:
"my-strict-rule"
The output rule. Each rule entry accepts an optional "message" field that is shown to the user when that specific rule is hit.
{ "name": "deny-select", "description": "<optional-description>", "input": { "rules": [ {"type": "deny_words_list", "words": ["SELECT"], "pattern_regex": "", "name": "<optional-name>", "message": "<optional-message>"} ] }, "output": { "rules": [ {"type": "pattern_match", "words": [], "pattern_regex": "[A-Z0-9]+", "message": "<optional-message>"} ] } }
Show child attributes
Show child attributes
SidecarSpec is this rule in the sidecar's own vocabulary; see the request type. Present only in a control plane.
The sidecar listeners this rule is bound to, and therefore distributed to
Show child attributes
Show child attributes
The time the resource was updated
Example:
"2024-07-25T15:56:35.317601Z"
Was this page helpful?