canonical: https://jentic.com/apis/googleapis.com/serviceusage

# Google Service Usage API

Service Usage is the consumer-side API for managing which Google Cloud services are enabled on a project, folder, or organization. Agents can list every available service in the catalogue, see which are currently enabled, enable or disable a service, and batch enable up to 20 services in one call. It is the API behind 'Enable APIs and services' in the GCP console and the foundation for any tooling that bootstraps GCP projects.

## For AI agents

List, enable, and disable Google Cloud services on a project, folder, or organization in bulk or one at a time.

## Scope

Does not handle project creation, IAM role assignment, or quota requests - use for listing and toggling Google service enablement on a project only.

## Capabilities

- List every Google service available to a parent (project, folder, or organization) with current enablement state
- Enable a single service on a project to make its API callable
- Disable a single service on a project to remove its API access
- Batch enable up to 20 services on a project in one call
- Retrieve metadata for a specific service including its config and dependencies
- Cancel and read long-running enablement operations

## Use cases

### GCP Project Bootstrap Automation

Tools that create new GCP projects programmatically use Service Usage to enable the right APIs (compute, run, sql-admin, secretmanager, monitoring, etc.) right after project creation. The batchEnable endpoint accepts up to 20 services per call, so a typical bootstrap finishes in a single round-trip plus operation polling.

Example prompt: Call POST /v1/{+parent}/services:batchEnable with serviceIds=['compute.googleapis.com','run.googleapis.com','secretmanager.googleapis.com'] and poll the returned operation.

### Security Posture and Surface Reduction

Periodically list enabled services on every project and disable any that are unused, reducing the attack surface and IAM blast radius. Pair Service Usage with Cloud Audit Logs to identify services with no activity over the last 90 days, then call disable on each one.

Example prompt: List services with filter='state:ENABLED', cross-reference Cloud Audit Logs, then call POST on each unused service's name with :disable.

### Pre-flight Capability Checks

Before running automation that depends on a particular API, tools call services.get to confirm the service is enabled and bail out cleanly if not. This avoids opaque permission errors deeper in the workflow and gives a clear remediation message - 'enable the X API on this project'.

Example prompt: Call GET /v1/{+name} on projects/{project}/services/run.googleapis.com and assert the response state equals ENABLED before proceeding.

### AI Agent GCP Onboarder

An AI agent acts as a GCP onboarding assistant - given a project id and a target workload type, it figures out which services are needed, batch enables them, and surfaces any quota or billing prerequisites. Through Jentic the agent searches by intent and never holds the long-lived service account credentials directly.

Example prompt: Given workloadType='ml-inference', batch enable aiplatform, run, storage, and secretmanager, then poll the operation and report any billing-disabled errors.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1/{+parent}/services | List every Google service for a parent |
| POST | /v1/{+parent}/services:batchEnable | Batch enable up to 20 services |
| POST | /v1/{+name}:enable | Enable a single service on a project |
| POST | /v1/{+name}:disable | Disable a service on a project |
| GET | /v1/{+name} | Get details and state of a single service |
| POST | /v1/{+name}:cancel | Cancel a long-running enablement operation |

## Key resources

- **services** — List, get, enable, disable, and batch enable Google services on a parent resource
- **operations** — Track and cancel long-running enablement operations

## Why Jentic

- **Setup:** Wiring Google Service Usage by hand means setting up a service account, minting OAuth access tokens against serviceusage.googleapis.com, and looking up canonical service names yourself. Through Jentic you install once, import the Service Usage API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** Service Usage puts the project and service in the URL path (/v1/{name}:enable, /v1/{name}:disable), so a rule can pin your agent to one project: it can list and enable services there and nothing else. You choose the operations it may call, so disable is not included unless you add it.
- **Credential handling:** Your Service Usage OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'enable Cloud Run on a project' or 'list enabled services', and Jentic returns the matching Service Usage operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Google Cloud Resource Manager API** — Manages projects, folders, and organizations - the parents that Service Usage operates on.
- **Google Cloud IAM API** — Manages service accounts and roles, including the IAM service agents created when an API is enabled.
- **Google Service Management API** — The producer-side counterpart for publishing services that consumers later enable via Service Usage.
- **Google Service Consumer Management API** — Producer-side API for managing tenant projects whose services are enabled via Service Usage.

## FAQ

### What authentication does the Service Usage API use?

Service Usage uses OAuth 2.0 with the cloud-platform scope and IAM permissions like roles/serviceusage.serviceUsageAdmin on the project, folder, or organization. Through Jentic the credentials are stored encrypted in your Jentic One instance and a scoped token is provided at execution.

### How many services can I batch enable at once?

Up to 20 service IDs in a single POST /v1/{+parent}/services:batchEnable call. For larger sets, split into batches and poll each returned long-running operation to completion.

### What are the rate limits for the Service Usage API?

Google enforces a default per-project quota of 600 read requests per minute and 60 write requests per minute. Enable and disable actions are long-running operations because they involve provisioning IAM service agents and quota allocations.

### How do I enable an API through Jentic?

Run the Jentic search query 'enable a google cloud service on a project', load POST /v1/{+name}:enable, and execute it with the service resource name like projects/{project}/services/run.googleapis.com. Jentic handles the OAuth token and operation polling.

### Can I enable services at the folder or organization level?

List and get operations support folder and organization parents. Enable and disable target a specific project; folder- and organization-level enablement is handled through organization policies rather than this API.

### Will disabling a service delete its data?

Disabling stops API calls from succeeding but does not delete underlying resources or data created via that API. Re-enabling the service restores access to existing resources, subject to any retention windows the service itself enforces.

### Can I limit what my agent is allowed to do with the Service Usage API?

Yes. Because Service Usage puts the project and service in the URL path, your self-hosted Jentic One instance lets you write rules that pin the agent to a single project, so it can list and enable services there and nothing else. You choose exactly which operations it may call, so a destructive action like disable stays off unless you explicitly add it. The OAuth credential is stored by your own instance and injected only at execution, so the agent never holds it directly.