curl --request GET \
--url https://use.hoop.dev/api/connections/{nameOrID}/federationimport requests
url = "https://use.hoop.dev/api/connections/{nameOrID}/federation"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://use.hoop.dev/api/connections/{nameOrID}/federation', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/connections/{nameOrID}/federation",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/connections/{nameOrID}/federation"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://use.hoop.dev/api/connections/{nameOrID}/federation")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/connections/{nameOrID}/federation")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": true,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}{
"message": "the error description"
}{
"message": "the error description"
}Get Federation Configuration for a Connection
Returns the IAM federation configuration for a connection. The admin credentials are never returned in plaintext; only a presence indicator is included.
curl --request GET \
--url https://use.hoop.dev/api/connections/{nameOrID}/federationimport requests
url = "https://use.hoop.dev/api/connections/{nameOrID}/federation"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://use.hoop.dev/api/connections/{nameOrID}/federation', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/connections/{nameOrID}/federation",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/connections/{nameOrID}/federation"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://use.hoop.dev/api/connections/{nameOrID}/federation")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/connections/{nameOrID}/federation")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": true,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}{
"message": "the error description"
}{
"message": "the error description"
}Path Parameters
Name or UUID of the connection
Response
OK
HookSource selects which resolver category the gateway runs. Only the built-in resolver category ships today; the field is preserved so new sources can be added without breaking existing configurations.
builtin "builtin"
AdminCredentialsJSON is the plaintext admin credential blob. Its shape is provider-specific: for gcp_iam it is the admin service-account JSON; for gcp_oauth it is the OAuth client config JSON ({"client_id":"...", "client_secret":"..."}). Write-only — never returned on GET. Required on the initial POST when HookSource=builtin; optional on PUT (omitting it leaves the stored value unchanged).
BuiltinProvider is required when HookSource=builtin. "gcp_iam" impersonates a per-user service account via an admin SA key; "gcp_oauth" mints tokens from a per-user Google OAuth refresh token (no service accounts).
gcp_iam, gcp_oauth "gcp_iam"
ConnectionID is the connection this federation config applies to. Populated by the server from the URL path on writes.
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
CreatedAt / UpdatedAt are server-set audit timestamps.
"2025-05-25T17:00:00Z"
ExtraConfig is provider-specific freeform JSON (e.g. {"project_id": "my-gcp-proj"}). The gateway does not interpret unknown keys.
Show child attributes
Show child attributes
FallbackPolicy controls behavior when resolution fails. "deny" aborts the session; "static" skips federation and lets the session run on the connection's existing static credentials.
deny, static "deny"
HasAdminCredentials is server-set on GET responses to let the UI know whether a credential is stored without exposing its value.
true
ID is the federation row's UUID. Empty on POST requests; populated on GET/PUT responses.
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
IdentitySourceAttribute is a JSONPath-like accessor into the Hoop user (defaults to $.user.email).
"$.user.email"
IdentityTargetTemplate is the principal template the source attribute substitutes into (defaults to "{user.email}").
"{user.email}"
TokenTTLSeconds caps the lifetime of generated credentials (default 3600, max 43200). Built-in providers may clamp lower based on cloud API limits.
3600
"2025-05-25T17:00:00Z"
Was this page helpful?