Install Jentic One Beta

Connect the Cloud Identity-Aware Proxy API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cloud Identity-Aware Proxy API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcloud.google.com%2Fiap" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcloud.google.com%2Fiap" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Cloud Identity-Aware Proxy API.

Read and update the IAP access settings for a resource

Get and set the IAM policy that controls who can reach an IAP-protected resource

Create and list OAuth brands for the project

Create and list Identity-Aware Proxy OAuth clients, and reset a client secret

List and create tunnel destination groups for TCP forwarding

GET STARTED

Start building with Cloud Identity-Aware Proxy API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Cloud Identity-Aware Proxy API for, with concrete tasks.

★ AI agent access policy management

An AI agent grants or revokes access to an IAP-protected app by reading the current IAM policy, editing the bindings, and setting the updated policy back. Through Jentic the agent finds the get and set policy operations by intent and calls them with the project's stored Google credential.

Add user alice@example.com as an IAP-secured Web App User on the target resource and confirm the policy

IAP settings automation

Platform teams keep IAP access settings consistent across many backend services by reading and updating each resource's settings from a script. The API exposes the settings for a resource so the desired configuration can be applied without clicking through the console.

Read the IAP settings for a backend service and update the access denial page URL

OAuth client provisioning

Provisioning IAP for a new app means creating an OAuth brand and an Identity-Aware Proxy OAuth client, then handing the client id and secret to the deployment. The API creates and lists brands and clients and can reset a client secret when it is rotated.

Create an Identity-Aware Proxy OAuth client under the project brand and return its client id

Key Endpoints

16 endpoints — the cloud identity-aware proxy api configures google cloud's identity-aware proxy: it reads and updates iap access settings, manages oauth brands and identity-aware proxy oauth clients, and gets or sets the iam policy that decides who can reach a protected resource.

METHOD

PATH

DESCRIPTION

GET

/v1/{name}:iapSettings

Get IAP access settings for a resource

PATCH

/v1/{name}:iapSettings

Update IAP access settings

POST

/v1/{resource}:getIamPolicy

Get the IAM access policy for a resource

POST

/v1/{resource}:setIamPolicy

Set the IAM access policy for a resource

GET

/v1/{parent}/brands

List OAuth brands

POST

/v1/{parent}/identityAwareProxyClients

Create an Identity-Aware Proxy OAuth client

GET

/v1/{name}:iapSettings

Get IAP access settings for a resource

PATCH

/v1/{name}:iapSettings

Update IAP access settings

POST

/v1/{resource}:getIamPolicy

Get the IAM access policy for a resource

POST

/v1/{resource}:setIamPolicy

Set the IAM access policy for a resource

GET

/v1/{parent}/brands

List OAuth brands

POST

/v1/{parent}/identityAwareProxyClients

Create an Identity-Aware Proxy OAuth client

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Calling the Cloud Identity-Aware Proxy API by hand means obtaining an OAuth 2.0 access token with the right cloud-platform scope, building resource names, and formatting IAM policy bindings correctly. Through Jentic you install once, import the API, connect your Google credential, and your agent calls it.

Permission scoping

The resource name is carried in the URL path, so a rule can allow your agent to read IAP settings and the IAM policy while blocking writes that change access or reset a client secret. You pick the operations it may call, so privilege-changing writes are excluded unless you add them.

Credential isolation

Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and injected when the agent runs. It never appears in the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'grant access to an IAP app' or 'update IAP settings', and Jentic returns the matching Identity-Aware Proxy operation with its input schema, so the agent calls the right endpoint without parsing the API reference.

FAQs

Specific to using Cloud Identity-Aware Proxy API through Jentic.

Is there a Cloud Identity-Aware Proxy MCP server?

You don't need an MCP server to connect your agent to the Cloud Identity-Aware Proxy API. Jentic connects it directly from the API Directory: import the API, connect your Google credential, and your agent reads settings and sets IAM policy on demand.

Can I limit what my agent is allowed to do with the Cloud IAP API?

Yes. Write a rule that allows only the read operations for IAP settings and IAM policy, so the agent can audit access but cannot change who has access or reset a client secret. The resource name travels in the URL path, and every call the agent makes is logged.

What authentication does the Cloud IAP API use?

The Cloud Identity-Aware Proxy API authenticates with Google OAuth 2.0, per its OpenAPI spec. Through Jentic the OAuth credential is stored once by your self-hosted instance and injected at call time, so it never reaches the agent's context.

Can I grant a user access to an IAP-protected app with this API?

Yes. Read the current IAM policy for the resource, add a binding for the user with the IAP-secured Web App User role, and set the updated policy back. IAP enforces that policy on the next request to the protected app.

What are the rate limits for the Cloud IAP API?

The OpenAPI spec does not specify rate limits. Google applies per-project quotas to Identity-Aware Proxy admin calls, so check your Google Cloud console before running large policy sweeps.

How do I connect the Cloud IAP API to my AI agent?

Search the Jentic API Directory for the Cloud Identity-Aware Proxy operation you need, such as setting an IAM policy, and import it. To run it on your own infrastructure, install Jentic One from its GitHub repo, then your agent calls the API with your Google credential injected at execution time.

Cloud Google Cloud Identity-Aware Proxy API

Name: Cloud Identity-Aware Proxy API
Brand: Cloud IAP
Availability: InStock

Community OpenAPI document · agent-readyIdentity AuthAuthorizationoauth216 EndpointsREST

Know of an official OpenAPI document? Contribute it →

For Agents

Read and update IAP access settings, manage OAuth brands and Identity-Aware Proxy clients, and get or set the IAM policy that controls access to a protected resource.

Use for: Update the IAP access settings on a backend service, Grant a user access to an IAP-protected app, Check who currently has access to a resource, Create an OAuth client for Identity-Aware Proxy

Not supported: Does not authenticate end users or issue access tokens; it configures IAP policy and OAuth clients only. Use for Identity-Aware Proxy settings, IAM policy, and OAuth client management.

The Cloud Identity-Aware Proxy API configures Google Cloud's Identity-Aware Proxy: it reads and updates IAP access settings, manages OAuth brands and Identity-Aware Proxy OAuth clients, and gets or sets the IAM policy that decides who can reach a protected resource. Use it to control identity-based access to applications and VMs sitting behind IAP.

Jentic One on Github View OpenAPI Document

Connect the Cloud Identity-Aware Proxy API to your agent

Capabilities

Start building with Cloud Identity-Aware Proxy API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

Cloud Google Cloud Identity-Aware Proxy API