canonical: https://jentic.com/apis/googleapis.com/remotebuildexecution

# Google Remote Build Execution API

The Google Remote Build Execution API administers RBE instances and worker pools used to scale Bazel and other Remote Execution-API-compatible builds across distributed worker fleets. It supports creating, listing, updating, and deleting RBE instances, configuring worker pools that supply the build farm, and managing IAM bindings that govern who can submit work. Specialized create endpoints exist for AndroidCI, Kokoro, and Guitar instances, alongside a notification-test endpoint for verifying alert delivery.

## For AI agents

Provision and manage Bazel-compatible Remote Build Execution instances and worker pools, and configure IAM bindings that control which jobs can submit builds.

## Scope

Does not execute Bazel actions, store build cache contents, or schedule individual remote actions - use for administrative lifecycle of RBE instances, worker pools, and IAM bindings only.

## Capabilities

- Create, list, get, update, and delete RBE instances scoped to a Google Cloud project
- Manage worker pools that determine the machine type and concurrency available to a build farm
- Provision specialized AndroidCI, Kokoro, and Guitar instances from a single endpoint
- Bind and unbind IAM principals on RBE backends so build clients can authenticate
- Send a test notification to verify that monitoring channels are wired up correctly
- Track long-running operations that govern instance and worker pool lifecycle changes

## Use cases

### Auto-scaling Bazel build farm

A build platform team auto-scales worker pools attached to their RBE instance based on weekday traffic, calling the worker pool update endpoint to expand capacity in the morning and shrink it overnight. Coupled with the Remote Execution API on the data plane, this keeps Bazel build queue times bounded while controlling spend.

Example prompt: Call PATCH /v1alpha/{+name} on each worker pool under projects/my-org/instances/build-farm to set workerCount=200 at 09:00 and 30 at 21:00.

### Disposable per-team RBE instances

Each platform team gets a dedicated RBE instance provisioned from a template. An agent calls instance create to spin up the instance, attaches a sized worker pool, and binds the team's service account through createBackendIAMBinding. When the team is offboarded, the agent reverses the calls.

Example prompt: POST /v1alpha/{+parent}/instances to create instance team-x, POST /v1alpha/{+parent}/workerpools to attach a 100-worker pool, and POST /v1alpha/{+parent}:createBackendIAMBinding for the team service account.

### Notification health checks

Operators rely on RBE notifications for build farm degradation alerts. An agent runs a daily synthetic test by calling testNotify on each instance, confirming that the configured channel still delivers, and opening an incident when delivery fails. This catches misconfigured channels before a real outage.

Example prompt: Iterate RBE instances under projects/my-org and call POST /v1alpha/{+name}:testNotify on each, recording the response status.

### Agent-managed build farms through Jentic

An AI agent provisions short-lived RBE instances for migration testing through Jentic. It searches for the create operation by intent, runs the call, attaches a worker pool, and decommissions the instance once the migration verification job completes. OAuth tokens stay isolated in your Jentic One instance.

Example prompt: Search Jentic for 'create remote build execution instance', execute the create against projects/migration, attach a worker pool, then call delete after the job exits.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /v1alpha/{+parent}/instances | Create an RBE instance |
| GET | /v1alpha/{+name} | Get an RBE instance or worker pool |
| PATCH | /v1alpha/{+name} | Update an RBE instance or worker pool |
| DELETE | /v1alpha/{+name} | Delete an RBE instance or worker pool |
| POST | /v1alpha/{+parent}/workerpools | Create a worker pool attached to an instance |
| POST | /v1alpha/{+parent}:createBackendIAMBinding | Bind an IAM principal to an RBE backend |
| POST | /v1alpha/{+parent}:deleteBackendIAMBinding | Remove an IAM binding from an RBE backend |
| POST | /v1alpha/{+name}:testNotify | Send a test notification for an instance |

## Key resources

- **Instances** — Create, list, get, update, and delete RBE instances and specialized AndroidCI, Kokoro, and Guitar variants.
- **Worker Pools** — Configure machine type, count, and disk for the workers attached to an instance.
- **Backend IAM Bindings** — Bind and unbind IAM principals on RBE backends to control submission rights.
- **Operations** — Track long-running operations produced by lifecycle calls.

## Why Jentic

- **Setup:** Wiring the Remote Build Execution API by hand means setting up Google OAuth 2.0, minting scoped access tokens, and threading instance and worker-pool resource names through the v1alpha admin endpoints on admin-remotebuildexecution.googleapis.com. Through Jentic you install once, import the Remote Build Execution API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** This API puts the instance and worker pool in the URL path (/v1alpha/{+name} and /v1alpha/{+parent}/workerpools), so a rule can pin your agent to one RBE instance: it can read and create worker pools there and nothing else. You choose the operations it may call, so state-changing ones like deleting an instance or removing a backend IAM binding are not included unless you add them.
- **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and a scoped access token is injected at execution time. The credential never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a Remote Build Execution instance' or 'add a worker pool', and Jentic returns the matching admin operation with its input schema so the agent calls the right endpoint without browsing the discovery document.

## Related APIs

- **Cloud Build API** — Managed CI service that runs builds without operating an RBE worker pool.
- **Compute Engine API** — Supplies the underlying VM types that worker pools provision.
- **Artifact Registry API** — Stores the container images and packages produced by RBE-driven builds.
- **Cloud IAM API** — Manages the IAM principals that RBE backend bindings reference.

## FAQ

### What authentication does the Remote Build Execution API use?

It uses Google OAuth 2.0 with the cloud-platform scope, declared as Oauth2 and Oauth2c. Through Jentic, refresh tokens and service-account credentials are held encrypted in your Jentic One instance and exchanged for short-lived access tokens at execution time.

### Can I create worker pools through the Remote Build Execution API?

Yes. POST /v1alpha/{+parent}/workerpools creates a worker pool attached to an existing RBE instance, accepting machine type, worker count, disk size, and accelerator configuration. The endpoint returns a long-running operation that the agent polls until the workers are ready.

### What are the rate limits for the Remote Build Execution API?

Google Cloud applies per-project quotas to RBE control-plane calls; the dominant constraints are the maximum number of instances and worker pools per project, both raisable through the Cloud Console quotas page. Read calls have a per-minute quota that scales with project usage.

### How do I provision an RBE instance through Jentic?

Search Jentic for 'create remote build execution instance', load the schema for POST /v1alpha/{+parent}/instances, and execute with parent set to projects/PROJECT and the desired instance ID. Jentic exposes the long-running operation so the agent can poll until done before attaching worker pools.

### Is the Remote Build Execution API free?

The control-plane API itself is free within Google Cloud quotas, but the worker machines and any Cloud Storage used for the build cache are billed at standard Compute Engine and Cloud Storage rates. Costs scale with worker count, machine type, and uptime.

### How do I send a test notification through the RBE API?

Call POST /v1alpha/{+name}:testNotify with the instance resource name. The endpoint pushes a synthetic event through the configured notification channel, and the response indicates whether the channel accepted the message - useful for detecting silently broken alerting before an incident occurs.

### Can I limit what my agent is allowed to do with the Remote Build Execution API?

Yes. Because this API carries the instance and worker pool in the URL path (/v1alpha/{+name} and /v1alpha/{+parent}/workerpools), your self-hosted Jentic One instance lets you write a rule that pins the agent to a single RBE instance, where it can read and create worker pools and nothing else. You decide which operations the agent may call, so state-changing calls like deleting an instance or removing a backend IAM binding stay out of reach unless you explicitly add them. Your own rules govern which operations and OAuth credentials the agent uses, and those credentials are held by your Jentic One instance rather than exposed to the agent.