{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Codex Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"codex-integration","__idx":0},"children":["Codex Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connect OpenAI Codex to Capsule Security for complete visibility into AI coding assistant activity, including prompts, tool execution, and session lifecycle."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This integration uses Codex's hooks system to capture AI coding assistant activity. Hooks are shell commands that execute at specific points in Codex's lifecycle, providing automated workflows and audit capabilities."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following hooks are configured:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Hook Event"},"children":["Hook Event"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SessionStart"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Session initialization and context with MCP tools definitions"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["UserPromptSubmit"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User prompts before submission to the model"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PreToolUse"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool execution requests (before execution)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PostToolUse"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool execution results (after completion)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Stop"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent stop events when the agent finished responding"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Codex CLI"]}," installed"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," account with admin access"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-generate-the-configuration","__idx":3},"children":["Step 1: Generate the Configuration"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," and locate ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Codex"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Install"]}," — Capsule automatically generates a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," file containing:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hook commands for all lifecycle events"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An embedded authentication token scoped to your organization"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select your target platform to download the configuration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mac"]}," / ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Linux"]},": a single ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," file"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Windows"]},": a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule-codex-hooks.zip"]}," archive containing ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," and a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CapsuleCodexHook.ps1"]}," companion script"]}]}]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On Windows, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," invokes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CapsuleCodexHook.ps1"]}," at the path configured in the integration's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced Settings"]}," (default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["C:\\Program Files\\Capsule\\CapsuleCodexHook.ps1"]},"), so both files must be deployed. The platform downloads are not interchangeable — use each platform's own ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-deploy-the-configuration","__idx":4},"children":["Step 2: Deploy the Configuration"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuration-locations","__idx":5},"children":["Configuration Locations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Codex loads hooks from the following locations. Where you place the configuration determines who controls it and how much users can tamper with it:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Location"},"children":["Location"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Path"},"children":["Path"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Best for"},"children":["Best for"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.codex/hooks.json"]}," (macOS/Linux)",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"code","attributes":{},"children":["%USERPROFILE%\\.codex\\hooks.json"]}," (Windows)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["POVs, pilots, and quick tests"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Managed (enterprise)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Managed hooks directory declared in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requirements.toml"]}," at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/etc/codex/requirements.toml"]}," (macOS/Linux) or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["%ProgramData%\\OpenAI\\Codex\\requirements.toml"]}," (Windows)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Production fleets"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["User-space configuration is the fastest way to evaluate the integration — a single file copy with no infrastructure. For production, prefer the managed/enterprise location: user-space hooks can be edited or deleted by the user, and Codex ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://developers.openai.com/codex/hooks"},"children":["skips non-managed hooks"]}," until each user reviews and trusts them via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hooks"]},", while managed hooks are trusted by policy and cannot be disabled from the user hook browser."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"user-level-install-povs-and-quick-tests","__idx":6},"children":["User-Level Install (POVs and Quick Tests)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["macOS / Linux:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"mkdir -p ~/.codex\ncp hooks.json ~/.codex/hooks.json\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Windows (PowerShell, as Administrator):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"powershell","header":{"controls":{"copy":{}}},"source":"New-Item -ItemType Directory -Path \"$env:USERPROFILE\\.codex\" -Force | Out-Null\nCopy-Item -Path \"hooks.json\" -Destination \"$env:USERPROFILE\\.codex\\hooks.json\" -Force\nNew-Item -ItemType Directory -Path \"C:\\Program Files\\Capsule\" -Force | Out-Null\nCopy-Item -Path \"CapsuleCodexHook.ps1\" -Destination \"C:\\Program Files\\Capsule\\CapsuleCodexHook.ps1\" -Force\n","lang":"powershell"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Because user-level hooks are non-managed, each user must review and trust them once via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hooks"]}," (see Step 4), and trust must be re-granted whenever the configuration changes (for example, a rotated token)."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"managed-configuration-recommended-for-production","__idx":7},"children":["Managed Configuration (Recommended for Production)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Codex's ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://developers.openai.com/codex/enterprise/managed-configuration"},"children":["managed configuration"]}," lets administrators enforce the Capsule hooks fleet-wide:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use your device management solution to install the Capsule hook configuration into a dedicated directory on each endpoint (Codex does not distribute hook scripts — your MDM delivers the files)"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Deploy a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requirements.toml"]}," that points Codex at that directory:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["macOS / Linux"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/etc/codex/requirements.toml"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Windows"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["%ProgramData%\\OpenAI\\Codex\\requirements.toml"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["macOS via MDM"]},": a configuration profile in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["com.openai.codex"]}," preference domain (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requirements_toml_base64"]},")"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"toml","header":{"controls":{"copy":{}}},"source":"[hooks]\nmanaged_dir = \"/path/to/managed/hooks\"   # macOS/Linux (must exist; absolute path)\nwindows_managed_dir = 'C:\\path\\to\\managed\\hooks'\nallow_managed_hooks_only = true\n","lang":"toml"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["With ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allow_managed_hooks_only = true"]},", user and project hooks are blocked entirely — only administrator-approved hooks run, and users cannot disable or circumvent the Capsule integration"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Hooks from managed sources are trusted by policy: no per-user ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hooks"]}," review is required."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"mdm-distribution-to-user-paths","__idx":8},"children":["MDM Distribution to User Paths"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your organization is not ready for managed configuration, you can still automate deployment at scale by having your MDM write the configuration into each user profile. See the platform guides:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-intune"},"children":["Microsoft Intune"]}," (supports fully automated deployment from the Capsule portal)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-jamf"},"children":["Jamf Pro"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-kandji"},"children":["Kandji"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-jumpcloud"},"children":["JumpCloud"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-sccm"},"children":["Microsoft SCCM"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-manageengine"},"children":["ManageEngine Endpoint Central"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/mdm-tanium"},"children":["Tanium"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Note that hooks deployed this way are still user-level (non-managed), so each user must trust them via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hooks"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-restart-codex","__idx":9},"children":["Step 3: Restart Codex"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Hooks are loaded at session start. Exit any running Codex sessions and start a new one for the configuration to take effect."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-verify-the-installation","__idx":10},"children":["Step 4: Verify the Installation"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Start a new Codex CLI session"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If Codex warns that hooks require review, run ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hooks"]},", review the Capsule hooks, and trust them (not required for managed hooks)"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Execute a simple task to generate activity:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Create a new file called test.txt with the content \"Hello World\"\n"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory > Agents"]}," and confirm your Codex agent appears"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click on the agent and review the audit logs to verify events are captured:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Session start event"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["User prompt"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Tool execution"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Session activity"]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"troubleshooting","__idx":11},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If events are not appearing:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," is in the correct location"]}," for your platform (see Step 2) — if the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CODEX_HOME"]}," environment variable is set, Codex reads the configuration from there instead of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.codex"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Run ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hooks"]}," in Codex"]}," — if the Capsule hooks are listed but skipped, they have not been trusted yet; if nothing is listed, the file is not being loaded"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify the file syntax"]}," — ensure the file contains valid JSON:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"cat ~/.codex/hooks.json | python3 -m json.tool\n","lang":"bash"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Windows: verify the script path"]}," — the path inside ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," must match where ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CapsuleCodexHook.ps1"]}," was actually installed (see the integration's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced Settings"]},")"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Check that hooks are not disabled by policy"]}," — a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["requirements.toml"]}," with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[features] hooks = false"]}," turns the hooks feature off entirely"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Contact Capsule Security support"]}," if issues persist"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-considerations","__idx":12},"children":["Security Considerations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Codex hooks execute with your current environment credentials. Before deploying hooks:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review all hook scripts"]}," provided by Capsule Security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify the endpoint URL"]}," matches your organization's Capsule instance"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protect authentication tokens"]}," used by hooks (never commit ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hooks.json"]}," to version control)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Codex records hook trust against a hash of the hook definition — any modification to the deployed configuration revokes trust and requires re-approval, which protects users from silent tampering"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":13},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},": support@capsule.security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Include"]},": Your organization ID, integration status, and any error messages"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"references","__idx":14},"children":["References"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://developers.openai.com/codex/hooks"},"children":["Codex Hooks Documentation"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://developers.openai.com/codex/enterprise/managed-configuration"},"children":["Codex Managed Configuration"]}]}]}]},"headings":[{"value":"Codex Integration","id":"codex-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Generate the Configuration","id":"step-1-generate-the-configuration","depth":2},{"value":"Step 2: Deploy the Configuration","id":"step-2-deploy-the-configuration","depth":2},{"value":"Configuration Locations","id":"configuration-locations","depth":3},{"value":"User-Level Install (POVs and Quick Tests)","id":"user-level-install-povs-and-quick-tests","depth":3},{"value":"Managed Configuration (Recommended for Production)","id":"managed-configuration-recommended-for-production","depth":3},{"value":"MDM Distribution to User Paths","id":"mdm-distribution-to-user-paths","depth":3},{"value":"Step 3: Restart Codex","id":"step-3-restart-codex","depth":2},{"value":"Step 4: Verify the Installation","id":"step-4-verify-the-installation","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":3},{"value":"Security Considerations","id":"security-considerations","depth":2},{"value":"Support","id":"support","depth":2},{"value":"References","id":"references","depth":2}],"frontmatter":{"seo":{"title":"Codex Integration"}},"lastModified":"2026-07-13T09:07:10.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/codex","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}