canonical: https://jentic.com/apis/googleapis.com/recaptcha-enterprise # Google reCAPTCHA Enterprise API Google reCAPTCHA Enterprise protects websites and apps from fraudulent activity, spam, and abuse using risk scores derived from billions of signals. The API exposes operations to create site keys, evaluate user actions through assessments, define and reorder firewall policies, manage IP overrides, and migrate legacy reCAPTCHA keys. Risk scores returned by assessments power downstream decisions such as showing additional verification, throttling traffic, or blocking outright. ## For AI agents Score user actions for risk, manage site keys and firewall policies, and run IP overrides on Google reCAPTCHA Enterprise. ## Scope Does not handle WAF rule enforcement, network-layer DDoS mitigation, or end-to-end identity verification - use for action-level risk scoring, firewall policies, and site key management only. ## Capabilities - Create assessments to score the risk of a user action and receive a 0.0 to 1.0 risk score - Annotate previous assessments with the observed outcome to improve model accuracy - Create and manage reCAPTCHA Enterprise site keys for web and mobile clients - Define firewall policies that act on assessment scores and reorder them by priority - Add or remove IP overrides to allow-list trusted office or partner ranges - Migrate classic reCAPTCHA keys to reCAPTCHA Enterprise and retrieve their legacy secret ## Use cases ### Sign-up and Login Fraud Protection Sites send a reCAPTCHA token from their sign-up or login form to the Assessments API to receive a risk score and a list of reasons. Sites use that score to decide whether to allow the action, throw up additional verification, or block. Annotation calls back into the API help close the loop on which assessments turned out to be fraudulent. Example prompt: Call POST /v1/{+parent}/assessments with the token and expected action login, then route the user to MFA when the score is below 0.5. ### Firewall Policies for High-Risk Routes Firewall policies let teams declare actions (allow, block, redirect, substitute) keyed off assessment results without changing application code. Policies can be reordered to express priority, and IP overrides allow trusted networks to bypass them entirely. Example prompt: Create a firewall policy that blocks any request to /admin with score below 0.3, then call POST /v1/{+parent}/firewallpolicies:reorder to put it ahead of the default allow policy. ### Migrating Classic reCAPTCHA Keys Sites moving from classic reCAPTCHA to reCAPTCHA Enterprise need to migrate keys without breaking existing form integrations. The API exposes a migrate operation and a retrieveLegacySecretKey operation so the transition can be staged behind feature flags. Example prompt: Call POST /v1/{+name}:migrate on the legacy key resource, then POST /v1/{+key}:retrieveLegacySecretKey to fetch the secret needed by existing form posts. ### Agent-Driven Risk Triage A trust and safety agent uses Jentic to fetch assessments, annotate them with verified outcomes, and adjust firewall policies in response to fraud waves, replacing manual console work and giving the agent a clear audit trail of changes. Example prompt: Search Jentic for annotate a recaptcha assessment, load the schema for projects.assessments.annotate, and execute it with annotation LEGITIMATE for a manually verified user. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /v1/{+parent}/assessments | Create an assessment to score a user action | | POST | /v1/{+name}:annotate | Annotate a previous assessment with the observed outcome | | POST | /v1/{+name}:addIpOverride | Add an IP override to a firewall policy or key | | POST | /v1/{+name}:removeIpOverride | Remove an IP override | | POST | /v1/{+parent}/firewallpolicies:reorder | Reorder firewall policies by priority | | POST | /v1/{+name}:migrate | Migrate a classic reCAPTCHA key to reCAPTCHA Enterprise | | GET | /v1/{+key}:retrieveLegacySecretKey | Retrieve the legacy secret for a migrated key | ## Key resources - **assessments** — Per-action risk scoring with create and annotate operations - **keys** — Site keys for web and mobile clients with create, list, get, patch, delete - **firewallpolicies** — Firewall policies that act on assessment results, with reorder support - **ipOverrides** — IP overrides that bypass firewall policies for trusted networks - **relatedaccountgroups** — Group related accounts for multi-account abuse detection ## Why Jentic - **Setup:** Wiring the reCAPTCHA Enterprise API by hand means setting up Google OAuth 2.0 with the cloud-platform scope, refreshing scoped access tokens, and threading assessment, key, and firewall policy resource names through the calls on recaptchaenterprise.googleapis.com. Through Jentic you install once, import the reCAPTCHA Enterprise API from the API Directory, store the OAuth credential once, and your agent calls it. - **Permission scoping:** This API puts the assessment, key, and policy in the URL path (/v1/{+name} and /v1/{+parent}/assessments), so a rule can pin your agent to one project's keys and assessments: it can score actions and annotate within that scope and nothing else. You choose the operations it may call, so ones like retrieving a legacy secret key or migrating a key are not included unless you add them. - **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and a scoped access token is injected at execution time. The credential never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'score a user action' or 'add an IP override to a firewall policy', and Jentic returns the matching reCAPTCHA Enterprise operation with its input schema so the agent calls the right endpoint without navigating the reference docs. ## Related APIs - **Web Risk API** — Checks URLs against Google's threat lists for phishing and malware - **Safe Browsing API** — Checks URLs against Google's Safe Browsing lists - **Network Security API** — Manages Google Cloud network security policies that complement application-layer controls - **Binary Authorization API** — Enforces deploy-time policies for container images on Google Cloud ## FAQ ### What authentication does the reCAPTCHA Enterprise API use? The API uses Google OAuth 2.0 with the cloud-platform scope, sent as a Bearer token. Through Jentic the OAuth credentials live in the vault and short-lived access tokens are minted per call, so the underlying refresh token never enters the agent. ### What does an assessment score mean? An assessment returns a risk score from 0.0 (very likely abusive) to 1.0 (very likely legitimate) along with reasons such as AUTOMATION or UNEXPECTED_USAGE_PATTERNS. Sites set their own thresholds, with login forms typically allowing above 0.7, challenging the 0.3-0.7 band, and blocking below 0.3. ### What are the rate limits for the reCAPTCHA Enterprise API? Per-project quotas are documented in the reCAPTCHA Enterprise quotas page. Assessments scale to high QPS by default; firewall policy and key management calls are control-plane operations and have lower quotas. ### How do I score a sign-up through Jentic? Search Jentic for create a recaptcha assessment, load the schema for the projects.assessments.create operation which maps to POST /v1/{+parent}/assessments, and execute it with the token from the form, the site key, and the expected action. ### Is the reCAPTCHA Enterprise API free? Yes up to a generous monthly free tier of assessments per project, with overage pricing published on the reCAPTCHA Enterprise pricing page. Firewall policies and site key management are not separately billed. ### How do I add an IP override? Call POST /v1/{+name}:addIpOverride with the IP CIDR and override type (e.g., allow) on the firewall policy or key resource. Use removeIpOverride to revert when the trusted source is no longer needed. ### Can I limit what my agent is allowed to do with the reCAPTCHA Enterprise API? Yes. Because your Jentic One instance is self-hosted, your own rules decide which reCAPTCHA Enterprise operations and credentials the agent may use, and this API puts the project, key, and policy resource names in the URL path so a rule can pin the agent to a single project's keys and assessments. You can allow it to score user actions with POST /v1/{+parent}/assessments and annotate them, while withholding sensitive operations like migrating a classic key or retrieving a legacy secret unless you explicitly add them. The operator controls the exact set of operations and the OAuth credential the agent can reach at execution time.