# Network URL: https://docs.hanzo.ai/docs/openapi/network > Mounts the Hanzo Cloud NETWORKING surface: the tenant's Hanzo Zero Trust footprint — the overlay network, its routers and its services — served as clean, org-scoped REST off the unified cloud binary and fronting the Hanzo Zero Trust controller (hanzoai/zt, an ZT-based fabric). Also for this capability: **API** · [CLI](https://docs.hanzo.ai/docs/cli/network) · [MCP](https://docs.hanzo.ai/docs/mcp-tools/network) · [SDKs](https://docs.hanzo.ai/docs/sdks) Mounts the Hanzo Cloud NETWORKING surface: the tenant's Hanzo Zero Trust footprint — the overlay network, its routers and its services — served as clean, org-scoped REST off the unified cloud binary and fronting the Hanzo Zero Trust controller (hanzoai/zt, an ZT-based fabric). > [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | -------------- | -------------------------------------- | | **Base URL** | `https://api.hanzo.ai` | | **Operations** | 9 | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | ## Specification Specification pending — no HIP in [hanzoai/hips](https://github.com/hanzoai/hips) declares `capability: network` yet. What this capability serves is below, from the API document; what it is — the store it owns, how it meters, what it publishes — is written as a HIP under HIP-0139. ## Four surfaces | Surface | Reaches this capability as | Coverage | | -------- | ----------------------------------------------- | ------------------------------------------------------------------------- | | **REST** | `network` at its own prefix | 9 operations | | **CLI** | `hanzo network …` | 8 of 9 — the CLI pins the document on its own clock | | **SDK** | `NetworkApi` in every published client | 9 methods | | **MCP** | tool `network` on `https://api.hanzo.ai/v1/mcp` | 7 operations, 1 under the document's own id — ask `describe` for the rest | ## Quickstart ```bash export HANZO_API_KEY=sk-... # console.hanzo.ai → API keys ``` Then the first call — a read that needs nothing but the key. `GET /v1/network`, operation `get_network`: **CLI** ```bash hanzo network list ``` **SDK** **.ts** ```ts import { Configuration, NetworkApi } from 'hanzoai'; const api = new NetworkApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.getNetwork(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import NetworkApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = NetworkApi(client).get_network() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.NetworkAPI.GetNetwork(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, network_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = network_api::get_network(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.NetworkApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new NetworkApi(client).getNetwork(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/network \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **network** through the `network` tool, which names its 7 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_networks" } } }' ``` Answers `200` with `object` — ok. ## Endpoints | Endpoint | What it does | | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`GET /v1/network/{id}`](https://docs.hanzo.ai/docs/openapi/network/get-network-by-id) | Returns one overlay network by id, scoped to the caller's org. | | [`DELETE /v1/network/identities/{id}`](https://docs.hanzo.ai/docs/openapi/network/delete-network-identities-by-id) | Takes one of the org's fabric identities out of the org. | | [`GET /v1/network/identities`](https://docs.hanzo.ai/docs/openapi/network/get-network-identities) | Returns the fabric identities the caller's org owns. | | [`POST /v1/network/identities`](https://docs.hanzo.ai/docs/openapi/network/post-network-identities) | Puts the caller on the org's overlay as its own IAM subject. | | [`GET /v1/network/routers`](https://docs.hanzo.ai/docs/openapi/network/get-network-routers) | Returns the Zero Trust routers the caller's org owns. | | [`DELETE /v1/network/services/{id}`](https://docs.hanzo.ai/docs/openapi/network/delete-network-services-by-id) | Takes a name off the org's overlay: the two policies, the service and its two configs that publishing made, in that order, and the "\-host" role from each of the org's identities — that role exists only for the bind policy to select, and a role naming no service is one the identities endpoint refuses to write. | | [`GET /v1/network/services`](https://docs.hanzo.ai/docs/openapi/network/get-network-services) | Returns the Zero Trust edge services the caller's org owns. | | [`POST /v1/network/services`](https://docs.hanzo.ai/docs/openapi/network/post-network-services) | Puts a name on the org's overlay: a fabric service forwarding to host:port on whichever of the org's devices carries the "\-host" role, dialable at "\.\.zt" by any of the org's identities — and by the cloud's own, which is what lets a BYO cluster's apiserver be attached to the fleet with a ".zt" kubeconfig. | | [`GET /v1/network`](https://docs.hanzo.ai/docs/openapi/network/get-network) | Returns the caller's org overlay network on the Zero Trust fabric. | --- [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)