For Agents
Manage CBRS Spectrum Access System deployments, devices, and customers in the Google SAS testing environment, including device signing and installer validation.
Get started with SAS Portal API (Testing) in minutes using your preferred integration method.
# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
"jentic": {
"url": "https://api.jentic.com/mcp",
"auth": "oauth"
}
}
# Then ask your agent:
"register a cbsd device in google sas"
# → Jentic returns the GET /events tool with parameter schema, agent executes.What an agent can do with SAS Portal API (Testing) API.
Provision and migrate SAS customers, including legacy organizations and Google Cloud project deployments
Register, validate, and sign CBSD devices for CBRS deployments under a customer hierarchy
Manage SAS nodes and deployments to mirror real-world tower or campus topologies
Generate and validate installer secrets for technicians commissioning CBRS radios
GET STARTED
Use for: I need to register a new CBSD device in the SAS testing environment, Validate an installer secret for a field technician deploying a CBRS radio, Create a new SAS customer and bind it to a Google Cloud project deployment, List all deployments under a SAS customer to audit spectrum coverage
Not supported: Does not handle radio configuration, RF planning, or live production spectrum grants — use for Google SAS testing-environment customer, deployment, device, and installer management only.
The SAS Portal API (Testing) is the Google Spectrum Access System staging surface used for managing CBRS (Citizens Broadband Radio Service) deployments, customers, nodes, devices, and installer workflows. It exposes operations for provisioning customer hierarchies, registering and validating CBSDs, signing devices, and managing deployment-level Google Cloud project bindings. The testing endpoint mirrors production semantics so integrators can exercise SAS workflows safely before promoting them to live spectrum operations.
Get and set IAM-style policies that govern access to SAS resources
Run dry-run migrations and analytics setup for SAS customers ahead of production cutover
Patterns agents use SAS Portal API (Testing) API for, with concrete tasks.
★ CBRS Deployment Staging
Use the testing SAS Portal to stage and rehearse CBRS deployments before promoting them to production. Operators can create representative customers, nodes, and devices, then exercise the full installer and validation flow without affecting live spectrum allocation.
Create a SAS customer, attach a deployment to a Google Cloud project, register a CBSD with serial number TEST-1234, and validate an installer secret end-to-end.
Installer Workflow Automation
Field installation of CBRS radios requires generating short-lived installer secrets and validating them when the technician registers the device on site. The SAS Portal API exposes both halves of this flow so it can be wired into work order systems.
Call /v1alpha1/installer:generateSecret, deliver the secret to the technician via SMS, then later call /v1alpha1/installer:validate when they confirm the device is on site.
Customer Onboarding and Migration
Onboarding a new SAS customer involves creating the customer record, provisioning a deployment bound to a Google Cloud project, optionally migrating from a legacy organization, and setting up analytics. The API exposes each of these steps as discrete operations so onboarding can be automated.
Create a new SAS customer for a wireless ISP, call customers:provisionDeployment to bind a Google Cloud project, then call customers:setupSasAnalytics to enable reporting.
Agent-Driven SAS Test Harness
An AI agent rehearses CBRS deployment scenarios in the SAS testing environment via Jentic, exercising customer creation, device registration, signing, and policy retrieval to validate that orchestration logic behaves correctly before pointing at production.
Search Jentic for register a CBSD device, load the schema, and execute a dry-run registration against the testing endpoint with synthetic device parameters.
24 endpoints — the sas portal api (testing) is the google spectrum access system staging surface used for managing cbrs (citizens broadband radio service) deployments, customers, nodes, devices, and installer workflows.
METHOD
PATH
DESCRIPTION
/v1alpha1/customers:provisionDeployment
Provision a deployment for a customer
/v1alpha1/customers:migrateOrganization
Migrate a legacy organization into the SAS hierarchy
/v1alpha1/customers:setupSasAnalytics
Enable SAS analytics for a customer
/v1alpha1/installer:generateSecret
Generate a short-lived installer secret
/v1alpha1/installer:validate
Validate an installer secret on site
/v1alpha1/policies:set
Set the access policy on a SAS resource
/v1alpha1/customers:provisionDeployment
Provision a deployment for a customer
/v1alpha1/customers:migrateOrganization
Migrate a legacy organization into the SAS hierarchy
/v1alpha1/customers:setupSasAnalytics
Enable SAS analytics for a customer
/v1alpha1/installer:generateSecret
Generate a short-lived installer secret
/v1alpha1/installer:validate
Validate an installer secret on site
Three things that make agents converge on Jentic-routed access.
Credential isolation
Google OAuth 2.0 credentials are stored encrypted in the Jentic vault. Scoped access tokens are minted at call time so SAS Portal credentials never persist in the agent context, and revocation in the vault immediately disables agent access.
Intent-based discovery
Agents search Jentic by intent (e.g., register a CBSD, validate an installer, migrate a legacy organization) and Jentic returns the matching SAS Portal operation with its input schema, removing the need to navigate the alpha discovery doc.
Time to first call
Direct integration takes 3-7 days because the SAS Portal alpha surface has limited public docs and operationIds. Through Jentic: under 1 hour — search, load schema, execute.
Alternatives and complements available in the Jentic catalogue.
Identity and Access Management API
Manages the Google Cloud IAM identities that bind to SAS deployments
Use IAM to grant service accounts access to Google Cloud projects that back SAS deployments before calling SAS Portal endpoints.
Cloud Key Management Service API
Stores and rotates the cryptographic keys used to sign SAS device certificates
Use Cloud KMS when you need HSM-backed key custody for SAS device signing instead of letting Google manage signing keys directly.
Certificate Authority API
Issues private certificates used by CBSDs in custom PKI hierarchies
Use Certificate Authority Service when you need a private CA to issue device certificates outside Google's default SAS signing chain.
Specific to using SAS Portal API (Testing) API through Jentic.
What authentication does the SAS Portal API (Testing) use?
The API uses Google OAuth 2.0 with the userinfo.email and SAS-specific scopes documented by Google. Through Jentic the OAuth credentials live in the vault and short-lived access tokens are injected into requests so the underlying client secret never reaches the agent.
Is this API safe to use against live spectrum?
No, this is the testing surface (prod-tt) and is intended for integration rehearsal only. Use it to validate registration, validation, and installer flows; switch to the production SAS Portal API endpoint when promoting code to live CBRS deployments.
How do I register a CBSD device through Jentic?
Search Jentic for register a CBSD device, load the schema for the SAS Portal customers.devices create operation under /v1alpha1/{+parent}/devices, and execute it with the device serial number, FCC ID, and installation parameters from your provisioning system.
What are the rate limits for the SAS Portal API?
Quotas are configured per Google Cloud project under the SAS Portal service. The testing endpoint is intended for low-volume integration work and does not guarantee production-level throughput, so batch heavy onboarding runs.
Can I migrate a legacy organization through this API?
Yes, call POST /v1alpha1/customers:listLegacyOrganizations to find candidates, then POST /v1alpha1/customers:migrateOrganization to migrate them into the SAS customer hierarchy. Run this against the testing endpoint first to confirm the resulting topology before touching production.
How do I validate an installer secret?
Generate the secret with POST /v1alpha1/installer:generateSecret, deliver it to the technician, then call POST /v1alpha1/installer:validate with the same secret on site to authorize the installation.
/v1alpha1/policies:set
Set the access policy on a SAS resource