canonical: https://jentic.com/apis/googleapis.com/accessapproval

# Google Access Approval API

The Access Approval API gives Google Cloud customers explicit control over when Google personnel can access their data. It exposes operations to configure approval settings on a project, folder, or organisation, list pending approval requests, and approve, dismiss, or invalidate each request. Compliance and security teams use it to satisfy regulatory requirements that demand documented, customer-approved access by the cloud provider's support staff.

## For AI agents

Manage Google Cloud Access Approval settings and respond to approval requests so an agent can grant, dismiss, or invalidate Google personnel access on a project or organisation.

## Scope

Does not handle IAM role grants, VPC perimeter policies, or audit log retrieval - use for managing Access Approval settings and decisions only.

## Capabilities

- Configure Access Approval settings on a project, folder, or organisation, including notification recipients and enrolled services
- List pending and historical approval requests for a given resource scope
- Approve a specific access request to grant Google personnel time-bound access to customer data
- Dismiss an approval request to deny Google personnel access while preserving the audit record
- Invalidate a previously approved request to immediately revoke active Google personnel access
- Read the current Access Approval configuration to feed compliance dashboards

## Use cases

### Regulated Workload Compliance

A financial services team running regulated workloads on Google Cloud requires that every Google support engineer accessing their data is explicitly approved by a named officer. The Access Approval API exposes list, approve, dismiss, and invalidate operations on approvalRequests, with each decision captured in audit logs for downstream review.

Example prompt: List all PENDING approvalRequests under organizations/123456789, summarise each by requested resource and reason, and post a Slack message to the security channel with one-click approve and dismiss actions.

### Centralised Settings Management

A platform team manages Access Approval settings across hundreds of GCP projects from a central tool. The API exposes settings.get and updateAccessApprovalSettings on every project, folder, and organisation, so the team can roll out a uniform notification list and enrolled-service set without clicking through the console.

Example prompt: For every project under folders/987, set the Access Approval notification email to security-on-call@example.com and enrol all GA Google Cloud services.

### Incident Response Revocation

When a Google support case is closed, an incident-response runbook revokes the corresponding Access Approval to ensure no further Google personnel access. The invalidate operation immediately ends an approved access window while preserving the original approval record for audit.

Example prompt: Given a support case ID, find the matching approvalRequest, call invalidate, and write the resulting state to the incident timeline.

### AI Agent Compliance Triage

An AI agent embedded in the security operations console reviews Access Approval requests through Jentic. It summarises the requested resource, the stated reason, and any related support case before recommending approval or dismissal to the on-call officer.

Example prompt: Pull the latest 5 PENDING approvalRequests, look up each requested resource type, and reply with a recommended action and a one-paragraph justification.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1/{+parent}/approvalRequests | List approval requests under a project, folder, or organisation |
| GET | /v1/{+name} | Get a single approval request or settings resource |
| POST | /v1/{+name}:approve | Approve an access request |
| POST | /v1/{+name}:dismiss | Dismiss an access request |
| POST | /v1/{+name}:invalidate | Invalidate a previously approved request |

## Key resources

- **Approval Requests** — List, get, approve, dismiss, and invalidate Access Approval requests
- **Access Approval Settings** — Get and update enrolment, notification, and active-key settings on a project, folder, or organisation

## Why Jentic

- **Setup:** Wiring the Access Approval API by hand means setting up Google OAuth 2.0, exchanging refresh tokens for short-lived access tokens on every call, and pointing requests at the accessapproval.googleapis.com host with the right IAM scopes. Through Jentic you install once, import the Access Approval API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** Access Approval puts the approval-request resource in the URL path (/v1/{+name}), so a rule can pin your agent to one project's requests: it can list and read approval requests there and nothing else. You choose the operations it may call, so decision actions like approve, dismiss, or invalidate are not included unless you add them.
- **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and exchanged for short-lived access tokens at execution time. The refresh token never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list access approval requests' or 'approve a Google access request', and Jentic returns the matching Access Approval operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Access Context Manager API** — Define attribute-based access policies for Google Cloud services on the same organisation
- **Google Cloud IAM API** — Manage service accounts, roles, and policy bindings across the same projects
- **Cloud Resource Manager API** — Enumerate projects, folders, and organisations targeted by Access Approval settings

## FAQ

### What authentication does the Access Approval API use?

It uses Google OAuth 2.0 with the https://www.googleapis.com/auth/cloud-platform scope. The calling principal must hold the accessapproval.requests.approve and accessapproval.settings.update IAM roles on the target project, folder, or organisation. Jentic stores the OAuth credential in its encrypted vault and exchanges it for short-lived access tokens at request time.

### Can I approve a request without using the Cloud Console UI?

Yes. POST /v1/{name}:approve approves a specific approvalRequest by resource name, where name follows the format projects/{project}/approvalRequests/{request_id}. The same path supports :dismiss and :invalidate for the other state transitions.

### What are the rate limits for the Access Approval API?

Google does not publish a dedicated quota for Access Approval. Calls count against the standard Google Cloud APIs per-project quota, which defaults to 600 read requests and 60 write requests per minute. Approval decisions are inherently low-volume, so default quotas are rarely a constraint.

### How do I list pending approval requests through Jentic?

Run jentic search 'list pending google cloud access approval requests', load the approvalRequests.list operation, and execute it with the parent resource (e.g., projects/my-project) and a filter of state=PENDING. The agent receives a typed list of requests with requestedResourceName and requestedReason.

### Is the Access Approval API free?

Yes. There is no per-call charge for the Access Approval API. Customers must enrol the service on their organisation, and the underlying Google Cloud services that emit approval requests are billed normally.

### Can I limit what my agent is allowed to do with the Access Approval API?

Yes. Because you run Jentic One yourself, your own rules decide which Access Approval operations and which stored Google credential the agent may use. Since the approval-request resource sits in the URL path (/v1/{+name}), you can pin the agent to a single project's requests and let it only list and read them, while decision actions like approve, dismiss, and invalidate stay out of reach unless you explicitly add them. This way the operator controls exactly which endpoints and resource scope the agent can call.