canonical: https://jentic.com/apis/googleapis.com/recommender

# Google Recommender API

The Google Cloud Recommender API surfaces machine-learning-driven recommendations and insights about Google Cloud resources, helping teams optimize cost, security, performance, and reliability across projects, folders, and organizations. It exposes recommenders for areas such as idle VM detection, IAM role rightsizing, and commitment utilization, and lets clients mark recommendations as claimed, accepted, succeeded, failed, or dismissed to track lifecycle. Insights and recommendations are scoped per location and recommender type, with full IAM-controlled access and audit visibility.

## For AI agents

Fetch Google Cloud cost, security, and performance recommendations for projects and folders, and update each recommendation's lifecycle state as agents act on them.

## Scope

Does not apply changes to underlying Google Cloud resources, surface billing invoices, or provision new infrastructure - use for retrieving and updating the lifecycle of recommendations and insights only.

## Capabilities

- List active recommendations for a project, folder, or organization filtered by recommender type and location
- Mark a recommendation as claimed, accepted, succeeded, failed, or dismissed to track agent-driven remediation
- Retrieve insights that explain the underlying signals behind a Google Cloud recommendation
- Update recommender configuration to enable or disable specific recommendation types per scope
- Enumerate available recommenders and insight types so agents can discover what optimization signals exist
- Report whether an insight has been accepted by an operator or rejected to refine future recommendations

## Use cases

### Automated cost optimization sweep

Run a recurring agent that lists idle VM and rightsizing recommendations across every project in an organization, applies the suggested change through the Compute Engine API, and then marks each Recommender recommendation as succeeded so it stops appearing in dashboards. Combining listing, IAM-scoped filtering, and lifecycle marking lets cloud teams reclaim spend without manual review.

Example prompt: List recommendations under projects/my-prod/locations/us-central1/recommenders/google.compute.instance.IdleResourceRecommender, apply each, then call markSucceeded on every applied recommendation.

### Continuous IAM rightsizing

An agent enumerates IAM policy recommendations under each project, evaluates the suggested role reductions against an internal allow-list, applies safe changes via the IAM API, and marks accepted recommendations claimed and then succeeded. This closes the loop between detection and remediation for least-privilege enforcement.

Example prompt: List google.iam.policy.Recommender recommendations for projects/finance-prod, mark each as CLAIMED, apply the role changes, and call markSucceeded on completion.

### Security insight triage

Surface insights from security-focused recommenders into a triage queue, enrich them with the explanatory metadata returned from the insights endpoint, and let an agent dismiss low-value findings while escalating high-severity ones to a ticketing system. Each lifecycle change is recorded against the Recommender API so reporting stays consistent.

Example prompt: Iterate insights under projects/my-prod/locations/global/insightTypes/google.iam.policy.Insight, post HIGH severity items to PagerDuty, and call markAccepted on the rest.

### Agent-driven cloud governance through Jentic

An AI agent built on Jentic discovers Recommender operations by intent, loads the schema for listing and lifecycle endpoints, and runs a governance loop that pulls recommendations, applies safe ones, and marks them succeeded. Credentials stay isolated in Jentic's vault so agents never see raw OAuth tokens.

Example prompt: Search Jentic for 'list google cloud recommendations', load the Recommender list schema, execute against projects/my-prod, then call markSucceeded for each handled recommendation.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1beta1/{+parent}/recommendations | List recommendations for a parent scope and recommender |
| GET | /v1beta1/{+parent}/insights | List insights for a parent scope and insight type |
| POST | /v1beta1/{+name}:markAccepted | Mark a recommendation as accepted |
| POST | /v1beta1/{+name}:markClaimed | Mark a recommendation as claimed by an actor |
| POST | /v1beta1/{+name}:markSucceeded | Mark a recommendation as succeeded after applying |
| POST | /v1beta1/{+name}:markDismissed | Dismiss a recommendation so it no longer appears |
| GET | /v1beta1/recommenders | List available recommender types |
| GET | /v1beta1/insightTypes | List available insight types |

## Key resources

- **Recommendations** — List, get, and mark recommendations through their accepted, claimed, dismissed, succeeded, and failed lifecycle states.
- **Insights** — Retrieve insights that explain the data signals behind recommendations and update their state.
- **Recommenders** — Enumerate the available recommender types and configure per-project recommender behavior.
- **Insight Types** — List available insight types and configure their generation settings.

## Why Jentic

- **Setup:** Wiring the Recommender API by hand means setting up Google OAuth 2.0, refreshing scoped access tokens, and threading recommendation and insight resource names through the v1beta1 endpoints on recommender.googleapis.com. Through Jentic you install once, import the Recommender API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** This API puts the recommendation and insight in the URL path (/v1beta1/{+name} and /v1beta1/{+parent}/recommendations), so a rule can pin your agent to one project's recommendations: it can list and read within that scope and nothing else. You choose the operations it may call, so state-changing ones like marking a recommendation accepted or dismissed are not included unless you add them.
- **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and a scoped access token is injected at execution time. The credential never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list Google Cloud recommendations' or 'mark a recommendation accepted', and Jentic returns the matching Recommender operation with its input schema so the agent calls the right endpoint without browsing the discovery document.

## Related APIs

- **Cloud Monitoring API** — Pairs raw Cloud Monitoring metrics with Recommender's distilled optimization advice.
- **Cloud Asset API** — Provides asset inventory that contextualizes the resources Recommender targets.
- **Cloud Billing Budgets API** — Adds budget thresholds that pair with Recommender cost-saving signals.
- **Cloud Billing API** — Surfaces raw billing detail without machine-learned remediation suggestions.

## FAQ

### What authentication does the Recommender API use?

The Recommender API uses Google OAuth 2.0 with the cloud-platform scope, declared as the Oauth2 and Oauth2c security schemes in the spec. Through Jentic, OAuth tokens are stored encrypted in your Jentic One instance and exchanged at call time, so agents never receive raw refresh tokens or service account keys.

### Can I mark recommendations as accepted or dismissed with the Recommender API?

Yes. The API exposes lifecycle endpoints at /v1beta1/{+name}:markAccepted, :markClaimed, :markSucceeded, :markFailed, and :markDismissed. Each call requires the etag from the most recent get to avoid concurrent updates, and the response contains the updated state record.

### What are the rate limits for the Recommender API?

Google Cloud applies per-project quotas to the Recommender API; the standard default is 600 read requests per minute per project, with mutating mark calls counted against the same pool. Quotas can be increased through the Cloud Console quotas page once a project has demonstrated steady usage.

### How do I list cost recommendations for a project through Jentic?

Search Jentic for 'list google cloud recommendations', load the schema for GET /v1beta1/{+parent}/recommendations, and execute with parent set to projects/PROJECT/locations/LOCATION/recommenders/google.compute.instance.IdleResourceRecommender. Jentic returns the parsed recommendation list with etags ready for follow-up mark calls.

### Is the Recommender API free?

The Recommender API itself is free to call within Google Cloud quotas; you pay only for the underlying resources whose recommendations you act on, such as Compute Engine VMs or IAM-managed services. There is no per-recommendation charge for retrieval or lifecycle updates.

### Which recommenders and insight types can I enumerate?

Calling GET /v1beta1/recommenders and GET /v1beta1/insightTypes returns the full registry, including google.compute.instance.IdleResourceRecommender, google.iam.policy.Recommender, and google.cloudbilling.commitment.SpendBasedCommitmentRecommender, among others. Use these identifiers in subsequent list calls.

### Can I limit what my agent is allowed to do with the Recommender API?

Yes. Because Jentic One is self-hosted, your own rules decide which Recommender operations and credentials the agent may use. Since this API carries the project and recommendation names in the URL path, you can pin the agent to one project's recommendations so it only lists and reads within that scope. State-changing calls such as markAccepted or markDismissed are excluded unless you explicitly grant them.