curl --request PUT \
--url https://use.hoop.dev/api/connections/{nameOrID}/federation \
--header 'Content-Type: application/json' \
--data '
{
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": true,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}
'import requests
url = "https://use.hoop.dev/api/connections/{nameOrID}/federation"
payload = {
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": True,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}
headers = {"Content-Type": "application/json"}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
hook_source: 'builtin',
admin_credentials_json: '<string>',
builtin_provider: 'gcp_iam',
connection_id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
created_at: '2025-05-25T17:00:00Z',
extra_config: {},
fallback_policy: 'deny',
has_admin_credentials: true,
id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
identity_source_attribute: '$.user.email',
identity_target_template: '{user.email}',
token_ttl_seconds: 3600,
updated_at: '2025-05-25T17:00:00Z'
})
};
fetch('https://use.hoop.dev/api/connections/{nameOrID}/federation', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/connections/{nameOrID}/federation",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'hook_source' => 'builtin',
'admin_credentials_json' => '<string>',
'builtin_provider' => 'gcp_iam',
'connection_id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'created_at' => '2025-05-25T17:00:00Z',
'extra_config' => [
],
'fallback_policy' => 'deny',
'has_admin_credentials' => true,
'id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'identity_source_attribute' => '$.user.email',
'identity_target_template' => '{user.email}',
'token_ttl_seconds' => 3600,
'updated_at' => '2025-05-25T17:00:00Z'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/connections/{nameOrID}/federation"
payload := strings.NewReader("{\n \"hook_source\": \"builtin\",\n \"admin_credentials_json\": \"<string>\",\n \"builtin_provider\": \"gcp_iam\",\n \"connection_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"created_at\": \"2025-05-25T17:00:00Z\",\n \"extra_config\": {},\n \"fallback_policy\": \"deny\",\n \"has_admin_credentials\": true,\n \"id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"identity_source_attribute\": \"$.user.email\",\n \"identity_target_template\": \"{user.email}\",\n \"token_ttl_seconds\": 3600,\n \"updated_at\": \"2025-05-25T17:00:00Z\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://use.hoop.dev/api/connections/{nameOrID}/federation")
.header("Content-Type", "application/json")
.body("{\n \"hook_source\": \"builtin\",\n \"admin_credentials_json\": \"<string>\",\n \"builtin_provider\": \"gcp_iam\",\n \"connection_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"created_at\": \"2025-05-25T17:00:00Z\",\n \"extra_config\": {},\n \"fallback_policy\": \"deny\",\n \"has_admin_credentials\": true,\n \"id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"identity_source_attribute\": \"$.user.email\",\n \"identity_target_template\": \"{user.email}\",\n \"token_ttl_seconds\": 3600,\n \"updated_at\": \"2025-05-25T17:00:00Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/connections/{nameOrID}/federation")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"hook_source\": \"builtin\",\n \"admin_credentials_json\": \"<string>\",\n \"builtin_provider\": \"gcp_iam\",\n \"connection_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"created_at\": \"2025-05-25T17:00:00Z\",\n \"extra_config\": {},\n \"fallback_policy\": \"deny\",\n \"has_admin_credentials\": true,\n \"id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"identity_source_attribute\": \"$.user.email\",\n \"identity_target_template\": \"{user.email}\",\n \"token_ttl_seconds\": 3600,\n \"updated_at\": \"2025-05-25T17:00:00Z\"\n}"
response = http.request(request)
puts response.read_body{
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": true,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}{
"message": "the error description"
}{
"message": "the error description"
}{
"message": "the error description"
}Upsert Federation Configuration for a Connection
Creates or updates the IAM federation configuration for a connection. AdminCredentialsJSON is write-only; omit on update to preserve the stored value.
curl --request PUT \
--url https://use.hoop.dev/api/connections/{nameOrID}/federation \
--header 'Content-Type: application/json' \
--data '
{
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": true,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}
'import requests
url = "https://use.hoop.dev/api/connections/{nameOrID}/federation"
payload = {
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": True,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}
headers = {"Content-Type": "application/json"}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
hook_source: 'builtin',
admin_credentials_json: '<string>',
builtin_provider: 'gcp_iam',
connection_id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
created_at: '2025-05-25T17:00:00Z',
extra_config: {},
fallback_policy: 'deny',
has_admin_credentials: true,
id: '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
identity_source_attribute: '$.user.email',
identity_target_template: '{user.email}',
token_ttl_seconds: 3600,
updated_at: '2025-05-25T17:00:00Z'
})
};
fetch('https://use.hoop.dev/api/connections/{nameOrID}/federation', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://use.hoop.dev/api/connections/{nameOrID}/federation",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'hook_source' => 'builtin',
'admin_credentials_json' => '<string>',
'builtin_provider' => 'gcp_iam',
'connection_id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'created_at' => '2025-05-25T17:00:00Z',
'extra_config' => [
],
'fallback_policy' => 'deny',
'has_admin_credentials' => true,
'id' => '15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7',
'identity_source_attribute' => '$.user.email',
'identity_target_template' => '{user.email}',
'token_ttl_seconds' => 3600,
'updated_at' => '2025-05-25T17:00:00Z'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://use.hoop.dev/api/connections/{nameOrID}/federation"
payload := strings.NewReader("{\n \"hook_source\": \"builtin\",\n \"admin_credentials_json\": \"<string>\",\n \"builtin_provider\": \"gcp_iam\",\n \"connection_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"created_at\": \"2025-05-25T17:00:00Z\",\n \"extra_config\": {},\n \"fallback_policy\": \"deny\",\n \"has_admin_credentials\": true,\n \"id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"identity_source_attribute\": \"$.user.email\",\n \"identity_target_template\": \"{user.email}\",\n \"token_ttl_seconds\": 3600,\n \"updated_at\": \"2025-05-25T17:00:00Z\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://use.hoop.dev/api/connections/{nameOrID}/federation")
.header("Content-Type", "application/json")
.body("{\n \"hook_source\": \"builtin\",\n \"admin_credentials_json\": \"<string>\",\n \"builtin_provider\": \"gcp_iam\",\n \"connection_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"created_at\": \"2025-05-25T17:00:00Z\",\n \"extra_config\": {},\n \"fallback_policy\": \"deny\",\n \"has_admin_credentials\": true,\n \"id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"identity_source_attribute\": \"$.user.email\",\n \"identity_target_template\": \"{user.email}\",\n \"token_ttl_seconds\": 3600,\n \"updated_at\": \"2025-05-25T17:00:00Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://use.hoop.dev/api/connections/{nameOrID}/federation")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"hook_source\": \"builtin\",\n \"admin_credentials_json\": \"<string>\",\n \"builtin_provider\": \"gcp_iam\",\n \"connection_id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"created_at\": \"2025-05-25T17:00:00Z\",\n \"extra_config\": {},\n \"fallback_policy\": \"deny\",\n \"has_admin_credentials\": true,\n \"id\": \"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7\",\n \"identity_source_attribute\": \"$.user.email\",\n \"identity_target_template\": \"{user.email}\",\n \"token_ttl_seconds\": 3600,\n \"updated_at\": \"2025-05-25T17:00:00Z\"\n}"
response = http.request(request)
puts response.read_body{
"hook_source": "builtin",
"admin_credentials_json": "<string>",
"builtin_provider": "gcp_iam",
"connection_id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"created_at": "2025-05-25T17:00:00Z",
"extra_config": {},
"fallback_policy": "deny",
"has_admin_credentials": true,
"id": "15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7",
"identity_source_attribute": "$.user.email",
"identity_target_template": "{user.email}",
"token_ttl_seconds": 3600,
"updated_at": "2025-05-25T17:00:00Z"
}{
"message": "the error description"
}{
"message": "the error description"
}{
"message": "the error description"
}Path Parameters
Name or UUID of the connection
Body
The request body resource
HookSource selects which resolver category the gateway runs. Only the built-in resolver category ships today; the field is preserved so new sources can be added without breaking existing configurations.
builtin "builtin"
AdminCredentialsJSON is the plaintext admin credential blob. Its shape is provider-specific: for gcp_iam it is the admin service-account JSON; for gcp_oauth it is the OAuth client config JSON ({"client_id":"...", "client_secret":"..."}). Write-only — never returned on GET. Required on the initial POST when HookSource=builtin; optional on PUT (omitting it leaves the stored value unchanged).
BuiltinProvider is required when HookSource=builtin. "gcp_iam" impersonates a per-user service account via an admin SA key; "gcp_oauth" mints tokens from a per-user Google OAuth refresh token (no service accounts).
gcp_iam, gcp_oauth "gcp_iam"
ConnectionID is the connection this federation config applies to. Populated by the server from the URL path on writes.
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
CreatedAt / UpdatedAt are server-set audit timestamps.
"2025-05-25T17:00:00Z"
ExtraConfig is provider-specific freeform JSON (e.g. {"project_id": "my-gcp-proj"}). The gateway does not interpret unknown keys.
Show child attributes
Show child attributes
FallbackPolicy controls behavior when resolution fails. "deny" aborts the session; "static" skips federation and lets the session run on the connection's existing static credentials.
deny, static "deny"
HasAdminCredentials is server-set on GET responses to let the UI know whether a credential is stored without exposing its value.
true
ID is the federation row's UUID. Empty on POST requests; populated on GET/PUT responses.
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
IdentitySourceAttribute is a JSONPath-like accessor into the Hoop user (defaults to $.user.email).
"$.user.email"
IdentityTargetTemplate is the principal template the source attribute substitutes into (defaults to "{user.email}").
"{user.email}"
TokenTTLSeconds caps the lifetime of generated credentials (default 3600, max 43200). Built-in providers may clamp lower based on cloud API limits.
3600
"2025-05-25T17:00:00Z"
Response
OK
HookSource selects which resolver category the gateway runs. Only the built-in resolver category ships today; the field is preserved so new sources can be added without breaking existing configurations.
builtin "builtin"
AdminCredentialsJSON is the plaintext admin credential blob. Its shape is provider-specific: for gcp_iam it is the admin service-account JSON; for gcp_oauth it is the OAuth client config JSON ({"client_id":"...", "client_secret":"..."}). Write-only — never returned on GET. Required on the initial POST when HookSource=builtin; optional on PUT (omitting it leaves the stored value unchanged).
BuiltinProvider is required when HookSource=builtin. "gcp_iam" impersonates a per-user service account via an admin SA key; "gcp_oauth" mints tokens from a per-user Google OAuth refresh token (no service accounts).
gcp_iam, gcp_oauth "gcp_iam"
ConnectionID is the connection this federation config applies to. Populated by the server from the URL path on writes.
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
CreatedAt / UpdatedAt are server-set audit timestamps.
"2025-05-25T17:00:00Z"
ExtraConfig is provider-specific freeform JSON (e.g. {"project_id": "my-gcp-proj"}). The gateway does not interpret unknown keys.
Show child attributes
Show child attributes
FallbackPolicy controls behavior when resolution fails. "deny" aborts the session; "static" skips federation and lets the session run on the connection's existing static credentials.
deny, static "deny"
HasAdminCredentials is server-set on GET responses to let the UI know whether a credential is stored without exposing its value.
true
ID is the federation row's UUID. Empty on POST requests; populated on GET/PUT responses.
"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"
IdentitySourceAttribute is a JSONPath-like accessor into the Hoop user (defaults to $.user.email).
"$.user.email"
IdentityTargetTemplate is the principal template the source attribute substitutes into (defaults to "{user.email}").
"{user.email}"
TokenTTLSeconds caps the lifetime of generated credentials (default 3600, max 43200). Built-in providers may clamp lower based on cloud API limits.
3600
"2025-05-25T17:00:00Z"
Was this page helpful?