canonical: https://jentic.com/apis/cloud.google.com/iap

# Cloud Google Cloud Identity-Aware Proxy API

The Cloud Identity-Aware Proxy API configures Google Cloud's Identity-Aware Proxy: it reads and updates IAP access settings, manages OAuth brands and Identity-Aware Proxy OAuth clients, and gets or sets the IAM policy that decides who can reach a protected resource. Use it to control identity-based access to applications and VMs sitting behind IAP.

## For AI agents

Read and update IAP access settings, manage OAuth brands and Identity-Aware Proxy clients, and get or set the IAM policy that controls access to a protected resource.

## Scope

Does not authenticate end users or issue access tokens; it configures IAP policy and OAuth clients only. Use for Identity-Aware Proxy settings, IAM policy, and OAuth client management.

## Capabilities

- Read and update the IAP access settings for a resource
- Get and set the IAM policy that controls who can reach an IAP-protected resource
- Create and list OAuth brands for the project
- Create and list Identity-Aware Proxy OAuth clients, and reset a client secret
- List and create tunnel destination groups for TCP forwarding

## Use cases

### AI agent access policy management

An AI agent grants or revokes access to an IAP-protected app by reading the current IAM policy, editing the bindings, and setting the updated policy back. Through Jentic the agent finds the get and set policy operations by intent and calls them with the project's stored Google credential.

Example prompt: Add user alice@example.com as an IAP-secured Web App User on the target resource and confirm the policy

### IAP settings automation

Platform teams keep IAP access settings consistent across many backend services by reading and updating each resource's settings from a script. The API exposes the settings for a resource so the desired configuration can be applied without clicking through the console.

Example prompt: Read the IAP settings for a backend service and update the access denial page URL

### OAuth client provisioning

Provisioning IAP for a new app means creating an OAuth brand and an Identity-Aware Proxy OAuth client, then handing the client id and secret to the deployment. The API creates and lists brands and clients and can reset a client secret when it is rotated.

Example prompt: Create an Identity-Aware Proxy OAuth client under the project brand and return its client id

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/v1/{name}:iapSettings` | Get IAP access settings for a resource |
| PATCH | `/v1/{name}:iapSettings` | Update IAP access settings |
| POST | `/v1/{resource}:getIamPolicy` | Get the IAM access policy for a resource |
| POST | `/v1/{resource}:setIamPolicy` | Set the IAM access policy for a resource |
| GET | `/v1/{parent}/brands` | List OAuth brands |
| POST | `/v1/{parent}/identityAwareProxyClients` | Create an Identity-Aware Proxy OAuth client |

## Key resources

- **IAP settings** — Read and update the Identity-Aware Proxy access settings for a resource
- **IAM policy** — Get, set, and test the IAM policy that controls access to a protected resource
- **OAuth brands and clients** — Create and list OAuth brands and Identity-Aware Proxy clients, and reset a client secret

## Why Jentic

- **Setup:** Calling the Cloud Identity-Aware Proxy API by hand means obtaining an OAuth 2.0 access token with the right cloud-platform scope, building resource names, and formatting IAM policy bindings correctly. Through Jentic you install once, import the API, connect your Google credential, and your agent calls it.
- **Permission scoping:** The resource name is carried in the URL path, so a rule can allow your agent to read IAP settings and the IAM policy while blocking writes that change access or reset a client secret. You pick the operations it may call, so privilege-changing writes are excluded unless you add them.
- **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and injected when the agent runs. It never appears in the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'grant access to an IAP app' or 'update IAP settings', and Jentic returns the matching Identity-Aware Proxy operation with its input schema, so the agent calls the right endpoint without parsing the API reference.

## Related APIs

- **Snyk** — Scans code, dependencies, and cloud config for security vulnerabilities.
- **Sublime Security** — Detects and responds to email-based threats with custom detection rules.

## FAQ

### Is there a Cloud Identity-Aware Proxy MCP server?

You don't need an MCP server to connect your agent to the Cloud Identity-Aware Proxy API. Jentic connects it directly from the API Directory: import the API, connect your Google credential, and your agent reads settings and sets IAM policy on demand.

### Can I limit what my agent is allowed to do with the Cloud IAP API?

Yes. Write a rule that allows only the read operations for IAP settings and IAM policy, so the agent can audit access but cannot change who has access or reset a client secret. The resource name travels in the URL path, and every call the agent makes is logged.

### What authentication does the Cloud IAP API use?

The Cloud Identity-Aware Proxy API authenticates with Google OAuth 2.0, per its OpenAPI spec. Through Jentic the OAuth credential is stored once by your self-hosted instance and injected at call time, so it never reaches the agent's context.

### Can I grant a user access to an IAP-protected app with this API?

Yes. Read the current IAM policy for the resource, add a binding for the user with the IAP-secured Web App User role, and set the updated policy back. IAP enforces that policy on the next request to the protected app.

### What are the rate limits for the Cloud IAP API?

The OpenAPI spec does not specify rate limits. Google applies per-project quotas to Identity-Aware Proxy admin calls, so check your Google Cloud console before running large policy sweeps.

### How do I connect the Cloud IAP API to my AI agent?

Search the Jentic API Directory for the Cloud Identity-Aware Proxy operation you need, such as setting an IAM policy, and import it. To run it on your own infrastructure, install Jentic One from its GitHub repo, then your agent calls the API with your Google credential injected at execution time.