I don't think this is at odds with HATEOAS, as long as you can embed state in the hypermedia URLs. Or you could provide a set of URLs and state data or a JWT or whatever, and the client would combine them all together in operation.