canonical: https://jentic.com/apis/googleapis.com/servicemanagement # Google Service Management API Google Service Management is the producer-side API for publishing and managing services on Google Cloud Platform's Service Infrastructure. Service producers create a service, submit configuration documents (.proto, OpenAPI, gRPC) describing endpoints and policies, manage rollouts that promote configs into production, and control which consumer projects have the service enabled. It powers the lifecycle of every Google API and customer-managed service that integrates with the Service Infrastructure. ## For AI agents Publish, configure, and roll out producer services on Google Cloud's Service Infrastructure with versioned configs and consumer project management. ## Scope Does not handle runtime admission control, tenant project provisioning, or end-user authentication - use for producer-side service publishing, configuration, and rollout management only. ## Capabilities - Create, list, get, undelete, and delete managed service definitions - Submit and list service configurations with schema, methods, and policy - Create rollouts that promote a configuration to production with traffic-percent strategies - Enable and disable a service for specific consumer projects - Manage IAM policy on a service to control who can administer it - Track long-running operations for asynchronous management actions ## Use cases ### Publish a Producer API on GCP Service producers register a new managed service with Service Management, submit an OpenAPI or proto-based service configuration that describes endpoints, authentication, quota, and billing, and roll the config out to production. Once published the service can be enabled on consumer projects, where Service Control then enforces it at runtime. Example prompt: Call POST /v1/services to create the managed service, then POST /v1/services/{serviceName}/configs with the OpenAPI configuration, then POST /v1/services/{serviceName}/rollouts with a 100 percent strategy. ### Versioned Configuration Rollouts Producers manage a stream of configuration revisions and roll them out gradually to reduce blast radius. Service Management stores every submitted config and lets you target a percentage of traffic to a new version with a TrafficPercentStrategy, then promote to 100 percent once metrics look good. Example prompt: Call POST /v1/services/{serviceName}/rollouts with trafficPercentStrategy { percentages: { 'cfg-2026-06': 10, 'cfg-2026-05': 90 } } to canary the new config. ### Consumer Project Enablement Producers control which consumer projects can consume their service. Calling enable on a service for a specific consumer project lets that project's workloads pass admission checks; disable revokes access cleanly. This is the lever behind 'enable this API in your project' in the GCP UI. Example prompt: Call POST /v1/services/{serviceName}:enable with consumerId='project:customer-project-id' to allow that project to call the service. ### AI Agent Service Owner An AI agent acts as the on-call service owner for a managed-service team - submitting new configs, watching rollouts, and toggling enablement for customers based on chat commands. Through Jentic the agent searches by intent and never sees the producer's organization-level service account keys directly. Example prompt: On a chat command 'roll out cfg-2026-06 to 25 percent', call services.rollouts.create with the right traffic strategy and report progress until done. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /v1/services | List managed services | | POST | /v1/services | Create a new managed service | | POST | /v1/services/{serviceName}/configs | Submit a new service configuration | | POST | /v1/services/{serviceName}/rollouts | Create a configuration rollout | | POST | /v1/services/{serviceName}:enable | Enable the service for a consumer project | | POST | /v1/services/{serviceName}:disable | Disable the service for a consumer project | ## Key resources - **services** — Create, list, undelete, and delete managed service definitions - **configs** — Submit, list, and retrieve service configuration documents - **rollouts** — Create and list rollouts that promote configs to production - **iam** — Get and set IAM policy on a managed service - **operations** — Track long-running configuration and rollout operations ## Why Jentic - **Setup:** Wiring Google Service Management by hand means provisioning a producer service account, minting OAuth access tokens against servicemanagement.googleapis.com, and navigating its nested config and rollout model yourself. Through Jentic you install once, import the Service Management API from the API Directory, store the OAuth credential once, and your agent calls it. - **Permission scoping:** Service Management puts the service name in the URL path (/v1/services/{serviceName}/rollouts), so a rule can pin your agent to one managed service: it can push configs and rollouts for that service and nothing else. You choose the operations it may call, so disabling a service is not included unless you add it. - **Credential handling:** Your Service Management OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'roll out a new service config' or 'enable a managed service', and Jentic returns the matching Service Management operation with its rollout strategy schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Google Service Control API** — Enforces the configurations that Service Management publishes, on every request. - **Google Service Consumer Management API** — Provisions tenant projects for customers of a service that Service Management has published. - **Google Service Usage API** — The consumer-side API for enabling and listing services on a project. - **Google Cloud API Keys API** — Provides API key based access control for callers, an alternative when full service publishing is not needed. ## FAQ ### What authentication does the Service Management API use? Service Management uses OAuth 2.0 with the cloud-platform or service.management scope and producer-side IAM permissions like roles/servicemanagement.serviceAdmin. Through Jentic the credentials are stored encrypted in your Jentic One instance and a scoped token is provided at execution. ### How do I roll back a bad service configuration? Create a new rollout that points trafficPercentStrategy at the previous good config name with 100 percent. Service Management treats rollbacks as forward rollouts to an earlier config so the audit trail remains complete. ### What are the rate limits for the Service Management API? Google enforces a default per-project quota of 600 read requests per minute and 60 write requests per minute. Many actions are long-running operations, so the practical pace is bounded by config-validation latency rather than the QPS limit. ### How do I enable a service for a customer through Jentic? Run the Jentic search query 'enable a managed service for a consumer project', load POST /v1/services/{serviceName}:enable, and execute it with consumerId='project:{project-id}'. Jentic handles the producer service account token. ### Can I list every configuration submitted for a service? Yes. GET /v1/services/{serviceName}/configs returns every submitted configuration with its id and createTime, paginated. GET on a specific config returns its full document for diffing. ### Is Service Management the same as Service Consumer Management? No. Service Management is for publishing and configuring the service itself; Service Consumer Management handles per-consumer tenant projects on top of a published service. You typically use both together. ### Can I limit what my agent is allowed to do with the Service Management API? Yes. Because Jentic One is self-hosted and governed by your own rules, you decide which Service Management operations your agent may call and which OAuth credential it uses. Service Management puts the service name in the URL path, so a rule can pin the agent to a single managed service and let it submit configs to /v1/services/{serviceName}/configs and create rollouts at /v1/services/{serviceName}/rollouts while nothing else is reachable. Sensitive actions like disabling a service for a consumer project are excluded unless you explicitly add them, so the agent operates only within the scope you define.