# Integrate Oso with Aperture

Last validated Jun 26, 2026

\[Missing snippet: aperture\_release\_note.mdx]

[Oso][xt-oso] is an authorization platform that provides fine-grained access control for AI agents. By connecting Aperture to Oso, you can send tool use data from LLM requests so Oso can make authorization decisions and provide observability into what your AI agents are doing.

Aperture sends data to Oso using the [hooks system][kb-configuration-hooks]. You configure a hook endpoint for Oso and a grant that specifies which requests trigger the hook and what data to include.

Oso is a third-party service. When Aperture forwards request data to it, Oso's use of that data is governed by your agreement with Oso, not your agreement with Tailscale.

\[Missing snippet: aperture\_async\_hook\_note.mdx]

## Prerequisites

Before you begin, ensure you have the following:

* A running [Aperture instance][kb-get-started] accessible from your device.
* An [Oso][xt-oso] account with an API key. If you don't have one, you can sign up from the Aperture dashboard.

## Configure the Oso hook

To integrate Oso with Aperture, configure a hook in Aperture that points to the Oso API endpoint. This lets you send tool use data to Oso for authorization decisions and observability.

1. Open the Aperture dashboard at `http://<aperture-hostname>/ui/`.

2. Go to the **Tool Use** page, then select **View Tool Use in Oso**.

3. Sign in to your Oso account (or sign up) and create an API key.

4. Go to **Administration** > **Configuration**.

5. Add an `oso` entry in the `hooks` section with your API key.

   ```json
   "hooks": {
       "oso": {
           "url": "https://api.osohq.com/api/agents/v1/model-request",
           "apikey": "<oso-api-key>"
       }
   }
   ```

   Replace `<oso-api-key>` with the API key you created in step 3.

6. Add a grant with a `send_hooks` entry that references the `oso` hook. The grant controls which requests trigger the hook and what data Aperture sends.

   ```json
   "grants": [
       {
           "src": ["*"],
           "app": {
               "tailscale.com/cap/aperture": [
                   {
                       "send_hooks": [
                           {
                               "name": "oso",
                               "events": ["tool_call_entire_request"],
                               "send": ["user_message", "tools", "request_body", "response_body"]
                           }
                       ]
                   }
               ]
           }
       }
   ]
   ```

   This configuration forwards full request and response bodies (`request_body` and `response_body`), which contain prompt and model-output content, not just tool-use metadata. Send only the data Oso needs for your authorization policies. To limit which users' requests trigger the hook, replace `"*"` in the `src` field with specific user identities or tags.

7. Save the configuration.

\[Missing snippet: aperture\_hooks\_config\_ref.mdx]

\[Missing snippet: aperture\_grant\_dst\_note.mdx]

## Verify the integration

After configuring the Oso hook, verify that Aperture is sending data to Oso and that it appears in the Oso dashboard.

1. Send a request through Aperture that includes a tool call and matches your grant conditions.
2. Open the [Oso dashboard][xt-oso] and confirm the tool use data appears.

\[Missing snippet: aperture\_verify\_hook\_wiring.mdx]

## Next steps

\[Missing snippet: aperture\_hooks\_next\_steps.mdx]

[kb-configuration-hooks]: /docs/aperture/configuration#hooks

[kb-get-started]: /docs/aperture/get-started

[xt-oso]: https://www.osohq.com/