canonical: https://jentic.com/apis/googleapis.com/apphub

# Google App Hub API

The Google Cloud App Hub API gives platform teams a single inventory of the applications running across their Google Cloud organization. It models Applications composed of Services and Workloads, with Service Project Attachments that bind compute projects to the central host, and DiscoveredServices and DiscoveredWorkloads that surface what is actually running. App Hub becomes the source of truth for application ownership, criticality, and environment.

## For AI agents

Catalog and govern Google Cloud applications, services, and workloads as first-class resources. Useful for agents that need to inventory infrastructure, attach ownership, or report on application health across many projects.

## Scope

Does not handle workload deployment, runtime metric collection, or alerting - use for cataloging applications, services, and workloads across Google Cloud projects only.

## Capabilities

- Register applications composed of services and workloads
- Attach service projects to a central App Hub host
- Discover services and workloads already running in attached projects
- Annotate applications with criticality, environment, and owner
- List applications and their composition across an organization
- Track long-running attach and detach operations

## Use cases

### Cross-project application inventory

Platform teams attach every compute project to a central App Hub host project and define applications that span those projects. Discovered services and workloads surface what is actually running, so leadership has a real-time map of what exists, who owns it, and how critical it is.

Example prompt: Create application 'orders-platform' in host project p with environment PRODUCTION and criticalityType MISSION_CRITICAL, then attach service project p-svc as a service project.

### Service ownership and on-call routing

Each application carries owner annotations (developer, operator, business). On-call tooling reads App Hub to know who to page when a downstream alert fires on a discovered service. The data model replaces wiki pages and spreadsheets that go stale.

Example prompt: Patch application orders-platform with developerOwners and operatorOwners email lists pulled from the team directory.

### Discovery-driven onboarding

Rather than re-modeling everything, teams call the discovered service and workload endpoints to surface what's already running and onboard those resources into App Hub by attaching them as Services or Workloads under an Application. Onboarding becomes incremental rather than a big-bang rewrite.

Example prompt: List discoveredServices in attached project p-svc and add the top 5 by request volume to application orders-platform as Services.

### AI agent platform inventory assistant via Jentic

An AI agent acting as a platform inventory assistant answers 'who owns service X' or 'what production apps depend on Cloud SQL' by querying App Hub through Jentic. The agent never holds the project's service account JSON, only short-lived scoped tokens at execution.

Example prompt: On the request 'who owns the orders service', look up the Service in App Hub, return developerOwners, and link the Application page.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1/{+parent}/applications | List applications under a host project |
| GET | /v1/{+parent}/discoveredServices | List discovered services in an attached project |
| GET | /v1/{+name}:lookupServiceProjectAttachment | Look up service project attachment metadata |
| POST | /v1/{+name}:detachServiceProjectAttachment | Detach a service project from the host |
| GET | /v1/{+name}/locations | List supported locations |
| DELETE | /v1/{+name} | Delete an application, service, or workload |

## Key resources

- **Applications** — Logical applications composed of services and workloads
- **Services** — Service entries within an application
- **Workloads** — Workload entries within an application
- **ServiceProjectAttachments** — Bindings between compute projects and the App Hub host
- **DiscoveredServices** — Services automatically detected in attached projects
- **DiscoveredWorkloads** — Workloads automatically detected in attached projects

## Why Jentic

- **Setup:** Wiring the App Hub API by hand means setting up Google OAuth2, granting a service account cross-project scopes, and refreshing access tokens for each catalog call yourself. Through Jentic you install once, import the App Hub API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** This API puts the resource name in the URL path (/v1/{parent}/applications, /v1/{name}), so a rule can pin your agent to one project or application: it can list applications and discovered services there and nothing else. You choose the operations it may call, so actions like deleting an application or detaching a service project are not included unless you add them.
- **Credential handling:** Your Google Cloud OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'register an application' or 'list discovered services', and Jentic returns the matching App Hub operation with its input schema so the agent calls the right endpoint without navigating the App Hub reference manually.

## Related APIs

- **App Engine Admin API** — Runs services that App Hub catalogs as part of an application.
- **Apigee Registry API** — Catalogs API specs and versions that may belong to App Hub services.
- **API Gateway API** — Fronts services that App Hub registers as part of an application.

## FAQ

### What authentication does the Google App Hub API use?

OAuth 2.0 with Google Cloud credentials. Through Jentic the credentials are vaulted and exchanged for scoped access tokens at runtime.

### Can I attach multiple service projects to one App Hub host?

Yes. Use the serviceProjectAttachments endpoints under /v1/{+parent}/serviceProjectAttachments to attach each compute project, after which discoveredServices and discoveredWorkloads under that attachment become visible to the host.

### What are the rate limits for the Google App Hub API?

Standard Google Cloud per-project per-minute quotas apply. App Hub is a control-plane service and is rarely a bottleneck, but bulk attachments and discovery listings should still page rather than fan-out aggressively.

### How do I attach a service project through Jentic?

Search Jentic for 'attach service project to app hub', load the schema for the serviceProjectAttachments.create operation, and execute it with the host project parent and the service project ID. Jentic returns the operation handle to poll until done.

### Is the Google App Hub API free?

App Hub itself is generally available without a separate per-call fee at the time of writing. Check Google's App Hub pricing page for the current tier; the underlying compute and observability services it points at are billed independently.

### What is the difference between a Service and a DiscoveredService?

A DiscoveredService is what App Hub automatically finds running in an attached project. A Service is what you have explicitly registered under an Application. Onboarding usually means promoting a discovered service into a registered Service with ownership and criticality.

### Can I limit what my agent is allowed to do with the Google App Hub API?

Yes. Because you run Jentic One yourself, your own rules decide which App Hub operations and credentials the agent may use, and this API puts the resource name in the URL path (/v1/{parent}/applications, /v1/{name}), so a rule can pin the agent to a single host project or application and let it only list applications and discovered services there. You pick the operations it can call, so write actions like deleting an application or detaching a service project stay out of reach unless you explicitly add them. Your Google Cloud OAuth credential is stored once by your own instance and injected only at execution, never entering the agent's prompt or logs.