Google Cloud Identity-Aware Proxy API
Browse all Google APIs40
AI ReadinessNon-Ready (F)40/100
Official vendor OpenAPI document · agent-readyIdentity AuthAuthenticationoauth216 EndpointsREST
For Agents
Configure Identity-Aware Proxy for Google Cloud apps and VMs: OAuth brands and clients, per-resource IAP settings, destination groups, and attribute expressions.
Use for: Get the current IAP settings on a Cloud Run service, Update an IAP access expression to require a specific group, Reset the OAuth client secret for an IAP-protected app, Create a destination group for IAP TCP forwarding
Not supported: Does not authenticate end users at runtime, route HTTP traffic, or run TCP tunnels - use for IAP control-plane configuration of brands, clients, settings, and destination groups only.
The Cloud Identity-Aware Proxy (IAP) API manages the configuration that fronts internal applications on Google Cloud with identity- and context-based access control. It is used to register OAuth brands and clients, configure per-resource IAP settings (such as access expressions and IAP-TCP tunnel options), maintain destination groups for TCP forwarding, validate attribute expressions, and reset OAuth client secrets. IAP itself enforces access at the load balancer in front of HTTP backends and Compute Engine VMs; this API is the control plane that defines how that enforcement behaves.
Install Jentic One Beta
Connect the Cloud Identity-Aware Proxy API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cloud Identity-Aware Proxy API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fiap" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fiap" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Cloud Identity-Aware Proxy API.
Create and manage OAuth brands that back IAP-protected applications
Register, list, and reset OAuth client secrets used by IAP for sign-in
Read and update per-resource IAP settings, including access expressions and TCP tunnel options
Manage destination groups that scope IAP TCP forwarding to specific internal hosts and ports
Validate IAP attribute expressions before deploying access rules
Delete IAP resources and brands during teardown of protected applications
Use Cases
Patterns agents use Cloud Identity-Aware Proxy API for, with concrete tasks.
★ Front Internal Apps with Identity-Based Access
Platform teams put IAP in front of internal admin tools so only signed-in users from approved groups can reach them. They use the IAP API to update each backend service's iapSettings (access expressions referencing groups, IP ranges, or device posture) and reset the OAuth client secret on rotation. The setup replaces VPN-only access for many internal tools.
For backend service projects/p/iap_web/compute/services/internal-admin, call PATCH /v1/{+name}:iapSettings to set accessSettings.allowedDomains to a list containing example.com and return the updated iapSettings.
IAP TCP Forwarding to Bastion-less SSH
Operations teams configure IAP TCP forwarding to give engineers SSH-over-IAP access to internal VMs without running a bastion host. Destination groups created via the API restrict which hosts and ports a given IAP-protected resource can reach, so policies are explicit and auditable.
Create a destination group named ssh-prod with destinations for hosts of pattern 10.0.1.0/24 and ports 22 under projects/p, and confirm the group appears in GET /v1/{+parent}/destGroups.
OAuth Brand and Client Lifecycle
When standing up a new IAP-protected app, teams use the API to register an OAuth brand for the project, create an identity-aware proxy client, and rotate its secret on schedule. Brands and clients are listed by parent for inventory, and resetSecret rotates the client secret used by IAP for sign-in to that app.
Under projects/p, POST a new brand with applicationTitle Internal-Admin, then POST an identity-aware proxy client under that brand named admin-web and return the resulting client_id and secret.
AI Agent IAP Settings Audit
An AI agent reviewing access controls calls the IAP API via Jentic to enumerate every IAP-protected resource in a project and validate that access expressions match the declared policy. Drift is reported with a suggested PATCH payload. Jentic isolates the IAP admin credential so the agent never holds raw service-account JSON.
List IAP settings across resources under projects/p by calling GET /v1/{+name}:iapSettings for each service, and emit a CSV of resource, accessSettings.gcipSettings, and accessSettings.allowedDomains.
Key Endpoints
16 endpoints — the cloud identity-aware proxy (iap) api manages the configuration that fronts internal applications on google cloud with identity- and context-based access control.
METHOD
PATH
DESCRIPTION
GET
/v1/{+name}:iapSettings
Get IAP settings for a resource
PATCH
/v1/{+name}:iapSettings
Update IAP settings for a resource
POST
/v1/{+name}:resetSecret
Reset the OAuth client secret for an identity-aware proxy client
POST
/v1/{+name}:validateAttributeExpression
Validate an IAP attribute expression
GET
/v1/{+parent}/brands
List OAuth brands under a project
POST
/v1/{+parent}/brands
Create an OAuth brand
GET
/v1/{+parent}/destGroups
List destination groups for IAP TCP forwarding
POST
/v1/{+parent}/destGroups
Create a destination group for IAP TCP forwarding
GET
/v1/{+name}:iapSettings
Get IAP settings for a resource
PATCH
/v1/{+name}:iapSettings
Update IAP settings for a resource
POST
/v1/{+name}:resetSecret
Reset the OAuth client secret for an identity-aware proxy client
POST
/v1/{+name}:validateAttributeExpression
Validate an IAP attribute expression
GET
/v1/{+parent}/brands
List OAuth brands under a project
POST
/v1/{+parent}/brands
Create an OAuth brand
GET
/v1/{+parent}/destGroups
List destination groups for IAP TCP forwarding
POST
/v1/{+parent}/destGroups
Create a destination group for IAP TCP forwarding
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
C
Cloud Identity-Aware Proxy API
- Non-Ready (F)40/100
69
Foundational Compliance56
Developer Experience & Jentic Compatibility17
AI-Readiness & Agent Experience94
Agent Usability63
Security70
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
69
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: B+Signals: 4
74%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
56
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: CSignals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
25%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
17
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
68%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
0%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
63
Security
Trust, risk posture, and security compliance.
Grade: B-Signals: 1
62%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
70
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: B+Signals: 1
70%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Cloud Identity-Aware Proxy API by hand means configuring admin OAuth2, narrowing to the cloud-platform scope, refreshing tokens, and URL-encoding its brand, client, and settings resource paths yourself. Through Jentic you install once, import the Cloud Identity-Aware Proxy API from the API Directory, store the credential once, and your agent calls it.
Permission scoping
Resource names travel in the URL path (/v1/{name}:iapSettings, /v1/{parent}/brands), so a rule can pin your agent to one project's IAP configuration: it reads and updates that project's settings and nothing else. You choose the operations it may call, so a client-secret reset is not included unless you add it.
Credential isolation
Your IAP admin credential is stored once, encrypted, by your own Jentic One instance and injected at execution time as a short-lived cloud-platform access token. The service-account key never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'update iap settings' or 'list oauth brands', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing the URL-encoded resource-name conventions.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Cloud Identity-Aware Proxy API through Jentic.
What authentication does the Cloud IAP API use?
Google OAuth 2.0 with the cloud-platform scope and an IAM principal that holds iap.* permissions on the resource being managed. Through Jentic the credential is stored encrypted and exchanged for a scoped access token at execution.
Can I update access policy on an IAP-protected service?
Yes. Call PATCH /v1/{+name}:iapSettings on the resource (a backend service, Cloud Run service, or App Engine app) with the desired accessSettings, including allowedDomains, gcipSettings, and corsSettings. The new settings take effect within minutes.
What are the rate limits for the IAP API?
Google enforces per-project quotas on IAP admin operations (default in the low hundreds of QPS). Settings updates are eventually consistent; callers should expect propagation latency of seconds to a few minutes.
How do I rotate an IAP client secret through Jentic?
Search Jentic with 'reset iap client secret', load the POST /v1/{+name}:resetSecret operation, and execute with name set to projects/{p}/brands/{brand}/identityAwareProxyClients/{clientId}. Jentic returns the new client secret, which can then be wired into your sign-in configuration.
Does this API issue tokens for end users hitting an IAP-protected app?
No. End-user sign-in to an IAP-protected app is handled by IAP itself at the load balancer. This API is the control plane for IAP configuration (brands, clients, settings, destination groups), not the runtime token issuer.
Can I limit what my agent is allowed to do with the Cloud Identity-Aware Proxy API?
Yes. Because you run Jentic One yourself, your own rules decide which IAP operations the agent may call and which credential it uses. Since resource names travel in the URL path, such as /v1/{name}:iapSettings and /v1/{parent}/brands, you can pin the agent to one project's IAP configuration so it only reads and updates that project's settings, brands, and destination groups. You choose the operations it can reach, so a client-secret reset via :resetSecret stays off unless you explicitly add it.
GET STARTED