Proxy Permissions

The Proxy Permissions API configures authentication groups and access control for proxy endpoints at both the container and project scope. Each proxy permissions document defines authentication groups (jwt, password, ip, token), per-group program access rules, a default fallback policy, and the proxy enable state. Container-level documents may also define per-service proxy hooks.

All write operations (PATCH, DELETE) require the optimistic-concurrency If-Match: file:v header. Read the current file_version from GET first; the server returns 428 when the header is absent and 412 when it is stale.

Container Proxy Permissions

GET /api/v1/containers/{id}/proxy/permissions

Retrieve the full proxy access control configuration for a container, including authentication groups, per-group program permissions, default policy, proxy enable state, and hooks.

SDK

const { data } = await client.api.proxyPermissionsContainer.get({
  id: "507f1f77bcf86cd799439012"
});

cURL

curl https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions \
  -H "Authorization: Bearer <token>"

Response · 200

{
  "statusCode": 200,
  "message": "Container proxy permissions retrieved successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny",
    "enable_proxy": true,
    "file_version": 3,
    "etag": "file:v3"
  }
}

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Container not found"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID

PATCH /api/v1/containers/{id}/proxy/permissions

Replace the entire container proxy permissions document. Use this for bulk rewrites; for targeted edits use the dedicated /default, /state, /groups/..., and /permissions/... endpoints below.

SDK

await client.api.proxyPermissionsContainer.replace({
  id: "507f1f77bcf86cd799439012",
  ifMatch: "file:v3",
  data: {
    project: "507f1f77bcf86cd799439011",
    container: "507f1f77bcf86cd799439012",
    groups: {
      admin: { type: "jwt", algorithm: "HS256", secret: "<jwt-secret>", sources: ["header:Authorization"] }
    },
    permissions: {
      admin: { terminal: "*", files: true }
    },
    default: "deny",
    enable_proxy: true
  }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": { "admin": { "type": "jwt", "algorithm": "HS256", "secret": "<jwt-secret>", "sources": ["header:Authorization"] } },
    "permissions": { "admin": { "terminal": "*", "files": true } },
    "default": "deny",
    "enable_proxy": true
  }'

Response · 200

{
  "statusCode": 200,
  "message": "Container proxy permissions updated successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid proxy permissions configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
project	string	Yes	Project ID owning this container (24-character hex)
container	string	Yes	Container ID (must match path :id, 24-character hex)
groups	object	Yes	Authentication groups. Key is group name; value is group config (jwt, password, ip, token)
permissions	object	Yes	Per-group program permissions. Map of program → access rule (boolean, port number, port list, port range, or "*")
default	string	No	Default access policy. One of allow, deny. Defaults to deny
enable_proxy	boolean	No	Enable or disable the proxy. Defaults to true
hooks	object	No	Per-service proxy hooks. Keys are service names; values are arrays of { match, script, timeout? } rules. Max 8 per service, 32 per file total. Reject-listed services: logs, proxy, workspaces

DELETE /api/v1/containers/{id}/proxy/permissions

Delete the container proxy permissions document and revert the container to open access.

SDK

await client.api.proxyPermissionsContainer.delete({
  id: "507f1f77bcf86cd799439012",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "Container proxy permissions deleted successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "allow"
  }
}

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Container not found"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

PATCH /api/v1/containers/{id}/proxy/permissions/default

Update only the default access policy that applies when no authentication group matches.

SDK

await client.api.proxyPermissionsContainer.updateDefault({
  id: "507f1f77bcf86cd799439012",
  ifMatch: "file:v3",
  data: { default: "allow" }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/default \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "default": "allow" }'

Response · 200

{
  "statusCode": 200,
  "message": "Default policy updated successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "allow"
  }
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
default	string	Yes	Default access policy for unmatched requests. One of allow, deny

PATCH /api/v1/containers/{id}/proxy/permissions/state

Enable or disable the proxy entirely for the container. When disabled, the proxy layer is bypassed and access control is removed.

SDK

await client.api.proxyPermissionsContainer.updateState({
  id: "507f1f77bcf86cd799439012",
  ifMatch: "file:v3",
  data: { enable_proxy: true }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/state \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "enable_proxy": true }'

Response · 200

{
  "statusCode": 200,
  "message": "Proxy state updated successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny",
    "enable_proxy": true
  }
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
enable_proxy	boolean	Yes	Enable or disable the proxy entirely

Container authentication groups

Authentication groups define WHO is allowed to reach the proxy. Each group has a type (jwt, password, ip, token) and the credentials needed to verify it.

PATCH /api/v1/containers/{id}/proxy/permissions/groups/{groupName}/ip

Configure an IP-based authentication group using an IPv4 CIDR range.

SDK

await client.api.proxyPermissionsContainer.setIpGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "office",
  ifMatch: "file:v3",
  data: { range: "192.168.1.0/24" }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/groups/office/ip \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "range": "192.168.1.0/24" }'

Response · 200

{
  "statusCode": 200,
  "message": "IP authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid IP CIDR range"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
range	string	Yes	IPv4 CIDR range (e.g. 192.168.1.0/24, 10.0.0.0/8, 203.0.113.5/32)

PATCH /api/v1/containers/{id}/proxy/permissions/groups/{groupName}/jwt

Configure a JWT-based authentication group with a signing algorithm, secret/public key, and token sources.

SDK

await client.api.proxyPermissionsContainer.setJwtGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "admin",
  ifMatch: "file:v3",
  data: {
    secret: "<jwt-secret>",
    algorithm: "HS256",
    sources: ["header:Authorization", "cookie:jwt_token"],
    claims: { role: "admin", level: 5 }
  }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/groups/admin/jwt \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{
    "secret": "<jwt-secret>",
    "algorithm": "HS256",
    "sources": ["header:Authorization"],
    "claims": { "role": "admin" }
  }'

Response · 200

{
  "statusCode": 200,
  "message": "JWT authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid JWT configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
secret	string	Yes	JWT secret. For HS256: any string. For RS256/ES256: PEM-encoded public key
algorithm	string	Yes	Signature algorithm. One of HS256, RS256, ES256
sources	array	Yes	Where to look for JWT tokens. Each entry uses the format header:Name or cookie:Name
claims	object	No	Required JWT claims to validate exactly. Values must be string, number, or boolean

PATCH /api/v1/containers/{id}/proxy/permissions/groups/{groupName}/password

Configure a username/password authentication group using SHA256 hashing.

SDK

await client.api.proxyPermissionsContainer.setPasswordGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "users",
  ifMatch: "file:v3",
  data: {
    username: "alice",
    password: "correct-horse-battery-staple",
    algorithm: "sha256",
    salt: "randomsalt123"
  }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/groups/users/password \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "alice",
    "password": "correct-horse-battery-staple",
    "algorithm": "sha256",
    "salt": "randomsalt123"
  }'

Response · 200

{
  "statusCode": 200,
  "message": "Password authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid password configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
username	string	Yes	Username to match exactly
password	string	Yes	Password plaintext or pre-hashed SHA256(salt + password) lowercase hex
algorithm	string	No	Hashing algorithm. Only sha256 is supported
salt	string	Yes	Salt used for password hashing (unique per group recommended)

PATCH /api/v1/containers/{id}/proxy/permissions/groups/{groupName}/token

Configure a static-token authentication group. Exactly one of header, cookie, or param must be supplied together with value.

SDK

// Header example
await client.api.proxyPermissionsContainer.setTokenGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "external-api",
  ifMatch: "file:v3",
  data: { header: "X-API-Key", value: "<static-token>" }
});

cURL

# Cookie example
curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/groups/external-api/token \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "cookie": "session", "value": "<static-token>" }'

Response · 200

{
  "statusCode": 200,
  "message": "Token authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid token configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

The body must contain exactly one location (header, cookie, or param) together with value.

Variant	Required Fields	Description
Header token	header, value	Match a header name (case-insensitive) against a literal token value
Cookie token	cookie, value	Match a cookie name (case-sensitive) against a literal token value
Query token	param, value	Match a query parameter name (case-sensitive) against a literal token value

DELETE /api/v1/containers/{id}/proxy/permissions/groups/{groupName}

Remove a single authentication group from the container document.

SDK

await client.api.proxyPermissionsContainer.removeAuthGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "office",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/groups/office \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "Authentication group removed successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Container or group not found"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Group name to remove
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Container program permissions

Program permissions define WHAT each authenticated group is permitted to access: a boolean (allow/deny all), a single port/index number, a list of ports, a port range, or "*".

Note

For programs files, services, notifications, and exec, only a boolean is allowed. For network programs like terminal, ssh, ui, http, use boolean, port number, port list, port range, or "*".

PATCH /api/v1/containers/{id}/proxy/permissions/permissions/{groupName}

Set a single program access rule for a group. The body specifies which program and which access rule to apply.

SDK

await client.api.proxyPermissionsContainer.setGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "admin",
  ifMatch: "file:v3",
  data: { program: "http", access: [80, 443] }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/permissions/admin \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "program": "http", "access": [80, 443] }'

Response · 200

{
  "statusCode": 200,
  "message": "Group program permission set successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid permission value"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
program	string	Yes	Program name (e.g. http, terminal, ssh, files, exec, services, notifications)
access	boolean | number | array | string	Yes	Access rule. Boolean for allow/deny all; number for a single port/index; array of numbers for specific ports; "low-high" string for a port range; "*" for wildcard allow-all

DELETE /api/v1/containers/{id}/proxy/permissions/permissions/{groupName}

Remove ALL program permissions for a group on this container in one call.

SDK

await client.api.proxyPermissionsContainer.removeGroup({
  id: "507f1f77bcf86cd799439012",
  groupName: "admin",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/permissions/admin \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "All group permissions removed successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

DELETE /api/v1/containers/{id}/proxy/permissions/permissions/{groupName}/{program}

Remove a single program’s access rule for a group, leaving all other programs untouched.

SDK

await client.api.proxyPermissionsContainer.removeProgram({
  id: "507f1f77bcf86cd799439012",
  groupName: "admin",
  program: "ssh",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/containers/507f1f77bcf86cd799439012/proxy/permissions/permissions/admin/ssh \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "Program permission removed successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "container": "507f1f77bcf86cd799439012",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Container ID
groupName	path	string	Yes	Group name
program	path	string	Yes	Program name (e.g. http, ssh, files)
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Project Proxy Permissions

Project-scoped proxy permissions apply as defaults to every container in the project. Container-level documents override project-level rules when both are present.

GET /api/v1/projects/{id}/proxy/permissions

Retrieve the full proxy access control configuration for a project.

SDK

const { data } = await client.api.proxyPermissionsProject.get({
  id: "507f1f77bcf86cd799439011"
});

cURL

curl https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions \
  -H "Authorization: Bearer <token>"

Response · 200

{
  "statusCode": 200,
  "message": "Project proxy permissions retrieved successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny",
    "enable_proxy": true,
    "file_version": 3,
    "etag": "file:v3"
  }
}

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Project not found"
}

Error Code	Title	Description	Resolution
PROJECT_NOT_FOUND	Project not found	The specified project ID does not exist or you do not have access to it	Verify the project ID is correct and that you have permission to access this project

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID

PATCH /api/v1/projects/{id}/proxy/permissions

Replace the entire project proxy permissions document. Use this for bulk rewrites; for targeted edits use the dedicated /default, /state, /groups/..., and /permissions/... endpoints below.

SDK

await client.api.proxyPermissionsProject.replace({
  id: "507f1f77bcf86cd799439011",
  ifMatch: "file:v3",
  data: {
    project: "507f1f77bcf86cd799439011",
    groups: {
      admin: { type: "jwt", algorithm: "HS256", secret: "<jwt-secret>", sources: ["header:Authorization"] }
    },
    permissions: {
      admin: { terminal: true, files: true }
    },
    default: "deny",
    enable_proxy: true
  }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{
    "project": "507f1f77bcf86cd799439011",
    "groups": { "admin": { "type": "jwt", "algorithm": "HS256", "secret": "<jwt-secret>", "sources": ["header:Authorization"] } },
    "permissions": { "admin": { "terminal": true, "files": true } },
    "default": "deny",
    "enable_proxy": true
  }'

Response · 200

{
  "statusCode": 200,
  "message": "Project proxy permissions updated successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid permissions configuration"
}

Error Code	Title	Description	Resolution
VALIDATION_ERROR	Invalid input parameters	The proxy permissions configuration contains invalid data or missing required fields	Check that all required fields are present and properly formatted according to the schema
INVALID_JWT_CONFIG	Invalid JWT configuration	JWT authentication group has invalid secret, algorithm, or sources configuration	Ensure JWT secret is valid for the algorithm, sources are properly formatted, and claims are scalar values
INVALID_IP_RANGE	Invalid IP CIDR range	IP authentication group has an invalid IPv4 CIDR notation	Use valid IPv4 CIDR format like 192.168.1.0/24 or 10.0.0.1/32

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Project not found"
}

Error Code	Title	Description	Resolution
PROJECT_NOT_FOUND	Project not found	The specified project ID does not exist or you do not have access to it	Verify the project ID is correct and that you have permission to access this project

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
project	string	Yes	Project ID (must match path :id, 24-character hex)
groups	object	Yes	Authentication groups. Key is group name; value is group config (jwt, password, ip, token)
permissions	object	Yes	Per-group program permissions. Map of program → access rule (boolean, port number, port list, port range, or "*")
default	string	No	Default access policy. One of allow, deny. Defaults to deny
enable_proxy	boolean	No	Enable or disable the proxy. Defaults to true

DELETE /api/v1/projects/{id}/proxy/permissions

Remove all proxy access control configuration from the project and revert to open access with the allow default policy.

SDK

await client.api.proxyPermissionsProject.delete({
  id: "507f1f77bcf86cd799439011",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "Project proxy permissions deleted successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "allow"
  }
}

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Project not found"
}

Error Code	Title	Description	Resolution
PROJECT_NOT_FOUND	Project not found	The specified project ID does not exist or you do not have access to it	Verify the project ID is correct and that you have permission to access this project

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

PATCH /api/v1/projects/{id}/proxy/permissions/default

Update only the default access policy that applies when no authentication group matches.

SDK

await client.api.proxyPermissionsProject.updateDefault({
  id: "507f1f77bcf86cd799439011",
  ifMatch: "file:v3",
  data: { default: "deny" }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/default \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "default": "deny" }'

Response · 200

{
  "statusCode": 200,
  "message": "Default policy updated successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid default policy value"
}

Error Code	Title	Description	Resolution
VALIDATION_ERROR	Invalid default policy	The default policy must be either allow or deny	Provide a valid default value: allow or deny

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Project not found"
}

Error Code	Title	Description	Resolution
PROJECT_NOT_FOUND	Project not found	The specified project ID does not exist or you do not have access to it	Verify the project ID is correct and that you have permission to access this project

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
default	string	Yes	Default access policy for unmatched requests. One of allow, deny

PATCH /api/v1/projects/{id}/proxy/permissions/state

Enable or disable the proxy entirely for the project. When disabled, the proxy layer is bypassed and all access control is removed.

SDK

await client.api.proxyPermissionsProject.updateState({
  id: "507f1f77bcf86cd799439011",
  ifMatch: "file:v3",
  data: { enable_proxy: false }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/state \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "enable_proxy": false }'

Response · 200

{
  "statusCode": 200,
  "message": "Proxy state updated successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny",
    "enable_proxy": false
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid enable_proxy value"
}

Error Code	Title	Description	Resolution
VALIDATION_ERROR	Invalid enable_proxy value	The enable_proxy field must be a boolean (true or false)	Provide a valid boolean value: true to enable proxy, false to disable

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Project not found"
}

Error Code	Title	Description	Resolution
PROJECT_NOT_FOUND	Project not found	The specified project ID does not exist or you do not have access to it	Verify the project ID is correct and that you have permission to access this project

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
enable_proxy	boolean	Yes	Enable or disable the proxy entirely

Project authentication groups

PATCH /api/v1/projects/{id}/proxy/permissions/groups/{groupName}/ip

Configure an IP-based authentication group for the project using an IPv4 CIDR range.

SDK

await client.api.proxyPermissionsProject.setIpGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "office",
  ifMatch: "file:v3",
  data: { range: "192.168.1.0/24" }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/groups/office/ip \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "range": "192.168.1.0/24" }'

Response · 200

{
  "statusCode": 200,
  "message": "IP authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid IP CIDR range"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
range	string	Yes	IPv4 CIDR range (e.g. 192.168.1.0/24, 10.0.0.0/8, 203.0.113.5/32)

PATCH /api/v1/projects/{id}/proxy/permissions/groups/{groupName}/jwt

Configure a JWT-based authentication group for the project with a signing algorithm, secret/public key, and token sources.

SDK

await client.api.proxyPermissionsProject.setJwtGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "admin",
  ifMatch: "file:v3",
  data: {
    secret: "<jwt-secret>",
    algorithm: "HS256",
    sources: ["header:Authorization"],
    claims: { role: "admin" }
  }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/groups/admin/jwt \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{
    "secret": "<jwt-secret>",
    "algorithm": "HS256",
    "sources": ["header:Authorization"],
    "claims": { "role": "admin" }
  }'

Response · 200

{
  "statusCode": 200,
  "message": "JWT authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid JWT configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
secret	string	Yes	JWT secret. For HS256: any string. For RS256/ES256: PEM-encoded public key
algorithm	string	Yes	Signature algorithm. One of HS256, RS256, ES256
sources	array	Yes	Where to look for JWT tokens. Each entry uses the format header:Name or cookie:Name
claims	object	No	Required JWT claims to validate exactly. Values must be string, number, or boolean

PATCH /api/v1/projects/{id}/proxy/permissions/groups/{groupName}/password

Configure a username/password authentication group for the project using SHA256 hashing.

SDK

await client.api.proxyPermissionsProject.setPasswordGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "users",
  ifMatch: "file:v3",
  data: {
    username: "admin",
    password: "correct-horse-battery-staple",
    algorithm: "sha256",
    salt: "randomsalt123"
  }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/groups/users/password \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "correct-horse-battery-staple",
    "algorithm": "sha256",
    "salt": "randomsalt123"
  }'

Response · 200

{
  "statusCode": 200,
  "message": "Password authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid password configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
username	string	Yes	Username to match exactly
password	string	Yes	Password plaintext or pre-hashed SHA256(salt + password) lowercase hex
algorithm	string	No	Hashing algorithm. Only sha256 is supported
salt	string	Yes	Salt used for password hashing (unique per group recommended)

PATCH /api/v1/projects/{id}/proxy/permissions/groups/{groupName}/token

Configure a static-token authentication group for the project. Exactly one of header, cookie, or param must be supplied together with value.

SDK

await client.api.proxyPermissionsProject.setTokenGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "api-clients",
  ifMatch: "file:v3",
  data: { header: "X-API-Key", value: "<static-token>" }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/groups/api-clients/token \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "header": "X-API-Key", "value": "<static-token>" }'

Response · 200

{
  "statusCode": 200,
  "message": "Token authentication group configured successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid token configuration"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Authentication group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

The body must contain exactly one location (header, cookie, or param) together with value.

Variant	Required Fields	Description
Header token	header, value	Match a header name (case-insensitive) against a literal token value
Cookie token	cookie, value	Match a cookie name (case-sensitive) against a literal token value
Query token	param, value	Match a query parameter name (case-sensitive) against a literal token value

DELETE /api/v1/projects/{id}/proxy/permissions/groups/{groupName}

Remove a single authentication group from the project document.

SDK

await client.api.proxyPermissionsProject.removeAuthGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "office",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/groups/office \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "Authentication group removed successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 404

{
  "statusCode": 404,
  "error": "Not Found",
  "message": "Project or group not found"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Group name to remove
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Project program permissions

PATCH /api/v1/projects/{id}/proxy/permissions/permissions/{groupName}

Set a single program access rule for a project group.

SDK

await client.api.proxyPermissionsProject.setGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "admin",
  ifMatch: "file:v3",
  data: { program: "http", access: true }
});

cURL

curl -X PATCH https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/permissions/admin \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3" \
  -H "Content-Type: application/json" \
  -d '{ "program": "http", "access": true }'

Response · 200

{
  "statusCode": 200,
  "message": "Group program permission set successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Response · 400

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid permission value"
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

Request Body

Name	Type	Required	Description
program	string	Yes	Program name (e.g. http, terminal, ssh, files, exec, services, notifications)
access	boolean | number | array | string	Yes	Access rule. Boolean for allow/deny all; number for a single port/index; array of numbers for specific ports; "low-high" string for a port range; "*" for wildcard allow-all

DELETE /api/v1/projects/{id}/proxy/permissions/permissions/{groupName}

Remove ALL program permissions for a group on this project in one call.

SDK

await client.api.proxyPermissionsProject.removeGroup({
  id: "507f1f77bcf86cd799439011",
  groupName: "admin",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/permissions/admin \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "All group permissions removed successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Group name
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first

DELETE /api/v1/projects/{id}/proxy/permissions/permissions/{groupName}/{program}

Remove a single program’s access rule for a project group, leaving all other programs untouched.

SDK

await client.api.proxyPermissionsProject.removeProgram({
  id: "507f1f77bcf86cd799439011",
  groupName: "admin",
  program: "http",
  ifMatch: "file:v3"
});

cURL

curl -X DELETE https://api.hoody.com/api/v1/projects/507f1f77bcf86cd799439011/proxy/permissions/permissions/admin/http \
  -H "Authorization: Bearer <token>" \
  -H "If-Match: file:v3"

Response · 200

{
  "statusCode": 200,
  "message": "Program permission removed successfully",
  "data": {
    "project": "507f1f77bcf86cd799439011",
    "groups": {},
    "permissions": {},
    "default": "deny"
  }
}

Parameters

Name	In	Type	Required	Description
id	path	string	Yes	Project ID
groupName	path	string	Yes	Group name
program	path	string	Yes	Program name (e.g. http, ssh, files)
if-match	header	string	No	If-Match: file:v ETag precondition — read current file_version from GET first