For Agents
Create rulesets, publish releases, and test Firebase security rules against synthetic requests so an agent can deploy and validate Firestore, Realtime Database, and Storage authorisation from CI.
Get started with Firebase Rules API in minutes using your preferred integration method.
# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
"jentic": {
"url": "https://api.jentic.com/mcp",
"auth": "oauth"
}
}
# Then ask your agent:
"test firebase security rules"
# → Jentic returns the GET /events tool with parameter schema, agent executes.What an agent can do with Firebase Rules API API.
Publish a new ruleset for Firestore, Realtime Database, or Cloud Storage
Promote a ruleset by creating or updating a named release such as cloud.firestore
Retrieve the compiled executable representation of a Firebase Rules release
Run rule unit tests against a ruleset with synthetic request contexts
GET STARTED
Use for: Publish a new Firestore security ruleset, Promote a ruleset to the cloud.firestore release, List all releases for a Firebase project, Test Firestore security rules against a synthetic request
Not supported: Does not authenticate end users, store data, or replace App Check attestation — use for managing and testing Firebase security rulesets and releases only.
The Firebase Rules API creates and manages the security rules that determine when a Firebase Rules-enabled service such as Cloud Firestore, Realtime Database, or Cloud Storage should permit a request. It exposes operations to manage rulesets (immutable rule documents), releases (named pointers to rulesets), fetch the executable form of a release, and run rule tests against synthetic requests. Use it to deploy and validate security rules from CI rather than the Firebase console.
List historical rulesets and releases for an audit trail of authorisation policy changes
Patterns agents use Firebase Rules API API for, with concrete tasks.
★ CI-Driven Security Rule Deployments
Wire a CI pipeline to publish a new Firebase Rules ruleset on every merge to main and update the cloud.firestore release to point at it via PATCH /v1/{+name}. The Firebase Rules API replaces the firebase deploy --only firestore:rules CLI flow with a deterministic REST chain, ideal when rules deploys must be gated by additional approvals before reaching production.
Call POST /v1/{+name}/rulesets to create a ruleset from the rules.firestore source, then PATCH /v1/{+name} on projects/PROJECT/releases/cloud.firestore to point at the new ruleset name.
Automated Rule Unit Testing
Run rule tests in CI by sending synthetic request contexts through POST /v1/{+name}:test against a candidate ruleset before promoting it. The endpoint reports whether each test case is allowed or denied, so a regression in security policy fails the build instead of reaching production. Test integration takes a few hours per project.
Call POST /v1/{+name}:test on the new ruleset name with a testSuite that includes a denied unauthenticated read and an allowed owner write, and fail the CI step if any expected outcome does not match.
Authorisation Policy Audit Trail
Use GET /v1/{+name}/releases and GET /v1/{+name}/rulesets to build an audit trail of every Firebase Rules version deployed to a project, including who promoted which ruleset to which release. This supports compliance reviews and post-incident investigations where you need to know which security policy was active at a given moment.
Call GET /v1/{+name}/releases for projects/PROJECT and pair each release.updateTime with the rulesetName it pointed at to produce a chronological audit log.
Agent-Driven Rule Reviews via Jentic
An AI agent connected through Jentic can review pending changes to Firebase Rules, run synthetic tests against the candidate ruleset, and recommend whether to promote it to a release. Jentic exposes the 9 Firebase Rules endpoints, the agent loads test, ruleset, and release operations, and OAuth 2.0 credentials remain inside the Jentic vault.
Through Jentic, search for test firebase security rules, load the projects.test operation, and execute it with a testSuite that exercises the change set against the candidate ruleset name.
9 endpoints — the firebase rules api creates and manages the security rules that determine when a firebase rules-enabled service such as cloud firestore, realtime database, or cloud storage should permit a request.
METHOD
PATH
DESCRIPTION
/v1/{+name}/rulesets
Create a new Firebase Rules ruleset
/v1/{+name}/rulesets
List rulesets under a project
/v1/{+name}/releases
Create a new Firebase Rules release
/v1/{+name}/releases
List releases under a project
/v1/{+name}
Update a release to point at a different ruleset
/v1/{+name}:test
Run rule tests against a ruleset
/v1/{+name}:getExecutable
Retrieve the executable representation of a release
/v1/{+name}/rulesets
Create a new Firebase Rules ruleset
/v1/{+name}/rulesets
List rulesets under a project
/v1/{+name}/releases
Create a new Firebase Rules release
/v1/{+name}/releases
List releases under a project
/v1/{+name}
Update a release to point at a different ruleset
Three things that make agents converge on Jentic-routed access.
Credential isolation
Google OAuth 2.0 service-account credentials are stored in the Jentic vault. Agents receive a scoped access token per call so the underlying private key never enters the agent's prompt or tool-call payloads.
Intent-based discovery
Agents search Jentic with intents like deploy firebase security rules or test firebase security rules and Jentic returns the matching rulesets.create, releases.patch, and projects.test operations along with their input schemas.
Time to first call
Direct integration with the Firebase Rules API: 2-3 days for OAuth, ruleset versioning, release pointer management, and rule test plumbing. Through Jentic: under 1 hour.
Alternatives and complements available in the Jentic catalogue.
Firebase App Check API
Attests that traffic comes from a genuine app before security rules even run.
Choose App Check to enforce app authenticity at the edge; use Firebase Rules to enforce per-document and per-path authorisation logic once the request has been admitted.
Firebase Realtime Database Management API
Provisions the Realtime Database instances whose access is governed by Firebase Rules.
Choose Realtime Database Management to create the instance, then use Firebase Rules to deploy the security rules document that governs reads and writes.
Google Identity Toolkit API
Authenticates end users that Firebase Rules can then authorise.
Choose Identity Toolkit to manage user identity and tokens; use Firebase Rules to make per-resource authorisation decisions based on the resulting auth context.
Specific to using Firebase Rules API API through Jentic.
What authentication does the Firebase Rules API use?
The API uses Google OAuth 2.0 with the firebase.readonly, firebase, or cloud-platform scope depending on whether the call is read-only or mutating. Through Jentic the OAuth credentials are stored in the encrypted vault and a scoped access token is supplied per request.
Can I deploy Firestore security rules with the Firebase Rules API?
Yes. POST /v1/{+name}/rulesets creates a new ruleset from your rules source, then PATCH /v1/{+name} on the cloud.firestore release pointer flips production traffic to it. This is the same flow that firebase deploy --only firestore:rules uses underneath.
What are the rate limits for the Firebase Rules API?
Google enforces standard googleapis.com project-level quotas for the Firebase Rules API. Ruleset creation is rate-limited because each ruleset is immutable and persisted; pipelines should avoid creating one ruleset per file change and instead bundle changes per release.
How do I run a Firebase Rules test through Jentic?
Run pip install jentic, search for test firebase security rules, load the projects.test operation, and execute it with the candidate rulesetName and a testSuite of synthetic request expectations. Sign up at https://app.jentic.com/sign-up.
Does the Firebase Rules API support Cloud Storage rules and Realtime Database rules?
Yes. The same ruleset and release machinery covers Cloud Firestore, Cloud Storage, and Realtime Database; the release name (such as cloud.firestore or firebase.storage) determines which Firebase service the ruleset is bound to.
Is the Firebase Rules API free?
Firebase Rules is included with Firebase at no extra charge. Rule evaluation cost is incurred only when a Firebase service evaluates the rules during a request, and that cost is billed under the underlying service such as Firestore or Cloud Storage.
/v1/{+name}:test
Run rule tests against a ruleset
/v1/{+name}:getExecutable
Retrieve the executable representation of a release