canonical: https://jentic.com/apis/googleapis.com/essentialcontacts

# Google Essential Contacts API

The Essential Contacts API lets Google Cloud customers register the right people to receive critical Google notifications about billing, technical, security, suspension, and legal events for their organisation, folder, or project. Contacts are scoped to a resource and subscribe to specific notification categories so notices reach the team that owns each domain. The API supports creating, updating, listing, computing effective contacts (by inheriting from parents), and sending test messages to verify routing. It is the canonical interface for ensuring outage and policy notifications never go to a stale single inbox.

## For AI agents

Register and manage the email contacts who receive Google Cloud billing, technical, security, and legal notifications, scoped per organisation, folder, or project.

## Scope

Does not send custom alerts, manage IAM members, or configure Cloud Monitoring channels - use for managing recipients of Google-originated billing, technical, security, and legal notifications only.

## Capabilities

- Create contacts with chosen notification categories (technical, billing, security, suspension, legal, product updates) on a resource
- Update an existing contact's notification categories or email after a team change
- List contacts directly attached to a resource and compute effective contacts inherited from parents
- Compute the effective contact set for a project by category, including inherited contacts
- Send a test message to a contact to confirm the email is reachable and properly routed
- Delete contacts that are no longer relevant to remove them from notification routing

## Use cases

### Cloud Hygiene at Onboarding

Cloud platform teams set up Essential Contacts as part of the standard project onboarding flow so every new project inherits org-level billing, technical, and security contacts and adds project-specific ones. The API is invoked by Terraform or a custom provisioning bot during project creation, replacing fragile manual UI steps. Once wired in, every new project gets correctly routed notifications from day one.

Example prompt: POST /v1/{+parent}/contacts on the new project with email='cloud-billing@company.com' and notificationCategorySubscriptions=['BILLING'].

### Periodic Contact Audits

Compliance and SRE teams audit essential contacts quarterly to catch addresses pointing to ex-employees or deprecated aliases. The API exposes the compute endpoint to roll up inherited contacts and sendTestMessage to validate deliverability on each one. Audits that took days of UI clicking finish in a single scripted run.

Example prompt: For each project, GET /v1/{+parent}/contacts:compute and call sendTestMessage on each contact, recording any whose delivery fails.

### Security Incident Routing

Security teams ensure that suspension and security-category notifications go to a 24/7 monitored alias rather than an individual inbox. The API attaches the right alias to the org or folder so all child projects inherit it, and updates are atomic - no need to touch each project. This becomes the documented control that satisfies auditor questions about incident-channel coverage.

Example prompt: POST /v1/{+parent}/contacts on the organisation with email='soc@company.com' and notificationCategorySubscriptions=['SECURITY','SUSPENSION'].

### Agent-Driven Contact Hygiene via Jentic

An AI agent that monitors HR offboarding events can scrub departing employees' emails from Essential Contacts across every project through Jentic. The agent finds the list, list-by-resource, and delete operations by intent and runs them in one pass without learning the per-resource pattern by hand.

Example prompt: Search Jentic for 'remove a Google Cloud essential contact', load DELETE /v1/{+name} schema, and execute it for every contact whose email matches the offboarded user.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /v1/{+parent}/contacts | Create a contact attached to an org, folder, or project |
| GET | /v1/{+parent}/contacts | List contacts directly attached to a resource |
| GET | /v1/{+parent}/contacts:compute | Compute effective contacts including inherited |
| PATCH | /v1/{+name} | Update a contact's email or notification categories |
| DELETE | /v1/{+name} | Delete a contact |
| POST | /v1/{+resource}/contacts:sendTestMessage | Send a test message to verify routing |

## Key resources

- **Contacts** — Create, list, get, update, and delete essential contacts attached to organisations, folders, or projects
- **Compute Contacts** — Compute the effective contact set for a resource including inherited contacts from parents
- **Test Message** — Send a test email to a contact to verify routing and deliverability

## Why Jentic

- **Setup:** Wiring the Essential Contacts API by hand means standing up Google OAuth2 with the right scopes, targeting essentialcontacts.googleapis.com, and building the resource-path calls yourself for managing notification recipients. Through Jentic you install once, import the Essential Contacts API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** Essential Contacts puts the resource name in the URL path (/v1/{+parent}/contacts, /v1/{+name}), so a rule can pin your agent to one project or organization: it can list and create contacts there and nothing else. You choose the operations it may call, so destructive ones like deleting a contact are not included unless you add them.
- **Credential handling:** Your Google OAuth credential for Essential Contacts is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list notification contacts for a project' or 'add a security contact', and Jentic returns the matching Essential Contacts operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Cloud Resource Manager API** — Manages the orgs, folders, and projects that contacts attach to
- **Cloud IAM API** — Grants the essentialcontacts.admin role to service accounts
- **Cloud Monitoring API** — Routes operational alerts via notification channels

## FAQ

### What authentication does the Essential Contacts API use?

Essential Contacts uses Google OAuth 2.0 with the cloud-platform scope. A service account or end-user with essentialcontacts.admin (or a parent role like resourcemanager.projectIamAdmin) on the resource can create and modify contacts. Through Jentic, service account keys are stored encrypted and the agent receives only short-lived Bearer tokens.

### Can I attach contacts at the organisation level so projects inherit them?

Yes. POST /v1/{+parent}/contacts on an organization or folder resource and child folders and projects automatically include those contacts when GET /v1/{+parent}/contacts:compute is called for the relevant categories.

### What are the rate limits for the Essential Contacts API?

Per-project quotas in the Cloud Console default to 600 read and 60 write requests per minute. There is no charge for the API, and quota increases can be requested through the standard Cloud Console quotas flow.

### How do I verify a contact actually receives notifications through Jentic?

Search Jentic for 'send a test essential contact message', load the POST /v1/{+resource}/contacts:sendTestMessage schema, and execute it with the contact resource name and the categories to test. Google sends a real test email to the contact.

### Is the Essential Contacts API free?

Yes. The API is free to use; only standard quota limits apply. The notifications themselves are also free - Essential Contacts is a control plane for Google's existing notification emails.

### How do I list every contact, including inherited ones, for a project?

Call GET /v1/{+parent}/contacts:compute with the project resource name and the notificationCategories you care about. The response includes contacts attached directly plus those inherited from the parent folder and organisation.

### Can I limit what my agent is allowed to do with the Essential Contacts API?

Yes. Because Essential Contacts puts the resource name in the URL path (/v1/{+parent}/contacts and /v1/{+name}), your own self-hosted Jentic One instance lets you write a rule that pins the agent to a single project or organization, so it can list and create contacts there and nowhere else. You decide which operations it may call, so destructive ones like deleting a contact are excluded unless you explicitly add them. The rules live with your instance, and the OAuth credential is injected at execution time rather than exposed to the agent.