canonical: https://jentic.com/apis/googleapis.com/sourcerepo

# Google Cloud Source Repositories API

The Cloud Source Repositories API manages private Git repositories hosted in a Google Cloud project. It provides operations to create and delete repos, list the repos within a project, mirror an existing GitHub or Bitbucket repository, and manage IAM policies that govern who can push, pull, or administer each repository. The API also exposes project-level Pub/Sub mirroring configuration, useful when triggering CI builds from repository activity.

## For AI agents

Create, list, and delete private Git repositories in Google Cloud, and manage their IAM policies. Suited for agents provisioning developer infrastructure inside a GCP project.

## Scope

Does not handle pull requests, code review, issue tracking, or in-browser code editing - use for managing private Git repositories and their IAM in GCP only.

## Capabilities

- Create a new private Git repository under a Google Cloud project
- List every repository in a project, paged for large org accounts
- Delete a repository when a project is decommissioned
- Configure project-level Pub/Sub topic mirroring of repository events
- Mirror an external GitHub or Bitbucket repository into Cloud Source Repositories
- Set, get, and test IAM policies that control push, pull, and admin access on a repo

## Use cases

### Project Bootstrap Automation

When a new GCP project is provisioned for a team, an automation creates a default Cloud Source Repository, applies an IAM policy granting the team's group push access, and configures Pub/Sub mirroring so Cloud Build can react to commits. The Cloud Source Repositories API exposes each of these steps as a discrete call, so the bootstrap script completes in under a minute.

Example prompt: Create repo projects/myproj/repos/app, then setIamPolicy granting roles/source.writer to group:devs@example.com, then configure projectConfig with the build-events Pub/Sub topic.

### GitHub Mirror for Compliance

Mirror business-critical GitHub repositories into Cloud Source Repositories so that audit logs and IAM controls live alongside other GCP resources. Calling repos.create with a mirrorConfig block establishes the one-way mirror; subsequent IAM and listing operations make the mirrored repo discoverable inside the project.

Example prompt: Call POST /v1/projects/myproj/repos with mirrorConfig.url=https://github.com/org/repo and a deployKeyId.

### Access Review Reporting

An access-review job iterates every repository in each project, fetches its IAM policy, and produces a report listing who has roles/source.writer or roles/source.admin. This supports periodic audits required by SOC 2 controls. The repos.list and getIamPolicy endpoints are paginated and IAM-scoped, so the report can run unattended.

Example prompt: List all repos in projects/myproj, then for each call getIamPolicy and emit a row per binding.

### AI Agent Repo Provisioning

An AI agent assigned to set up a new microservice asks Jentic for the operation that creates a Google source repository, loads the schema, then creates the repo and grants the requesting team push access - all without human intervention. Jentic handles the OAuth credential exchange so the agent never sees the underlying token.

Example prompt: Search Jentic for 'create a Google Cloud source repository', execute repos.create with the project parent, then setIamPolicy adding the new service team.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /v1/{+parent}/repos | Create a new repository in a project |
| GET | /v1/{+parent}/repos | List repositories in a project |
| GET | /v1/{+name} | Get a single repository or project resource |
| POST | /v1/{+name}:sync | Synchronise a mirrored repository |
| POST | /v1/{+resource}:setIamPolicy | Set the IAM policy on a repository |
| POST | /v1/{+resource}:getIamPolicy | Get the IAM policy on a repository |
| POST | /v1/{+resource}:testIamPermissions | Test which permissions the caller holds on a repository |

## Key resources

- **projects.repos** — Create, list, get, and delete repositories within a project, plus sync mirrored repos.
- **projects.repos IAM** — Get, set, and test IAM policies that control push, pull, and admin access on a repository.
- **projects.config** — Read and update project-level configuration including Pub/Sub topic mirroring of repository events.

## Why Jentic

- **Setup:** Wiring the Cloud Source Repositories API by hand means configuring a service account, minting OAuth access tokens against sourcerepo.googleapis.com, and refreshing them yourself. Through Jentic you install once, import the Cloud Source Repositories API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** Cloud Source Repositories puts the repo in the URL path (/v1/{name}, /v1/{resource}:setIamPolicy), so a rule can pin your agent to one repository: it can create, read, and sync that repo and nothing else. You choose the operations it may call, so setIamPolicy is not included unless you add it.
- **Credential handling:** Your Cloud Source Repositories OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a Cloud Source repository' or 'set IAM policy on a Git repo', and Jentic returns the matching Cloud Source Repositories operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **GitHub REST API** — GitHub hosts repositories on its own platform with richer collaboration features; Cloud Source Repositories keeps repos inside a GCP project.
- **Cloud Build API** — Cloud Build runs CI/CD pipelines triggered by commits in Cloud Source Repositories.
- **Google IAM API** — IAM defines the roles and policies that Cloud Source Repositories enforces on each repo.

## FAQ

### What authentication does the Cloud Source Repositories API use?

The Cloud Source Repositories API uses OAuth 2.0 with the cloud-platform or source.read_write scopes. Through Jentic, OAuth credentials are stored in your Jentic One instance and exchanged for short-lived access tokens, so service-account keys never enter the agent context.

### Can I mirror a GitHub repository into Cloud Source Repositories?

Yes. Pass a mirrorConfig block when calling POST /v1/projects/{project}/repos that specifies the source URL plus a deployKeyId and webhookId. Cloud Source Repositories then maintains a one-way mirror of the upstream GitHub or Bitbucket repository.

### What are the rate limits for the Cloud Source Repositories API?

Quotas are set at the Google Cloud project level - typically a few hundred read or write requests per minute, with stricter limits on repo creation. Quotas can be inspected and adjusted in the Google Cloud Console under IAM and admin > Quotas.

### How do I provision a new repo with IAM bindings through Jentic?

Search Jentic for 'create a Google Cloud source repository', execute the repos.create operation against POST /v1/{+parent}/repos, then call POST /v1/{+resource}:setIamPolicy on the new repo resource with the desired role bindings. Jentic returns the schemas for both calls so the agent can chain them in a single workflow.

### Is the Cloud Source Repositories API free?

Cloud Source Repositories includes a free tier of up to 5 project users and 50 GB storage. Beyond that, Google charges per active user per month and per GB of storage. The API itself has no separate per-call charge.

### Can I check if a service account can push to a repo before attempting?

Yes. POST /v1/{+resource}:testIamPermissions accepts a list of permissions like source.repos.update or source.repos.create and returns which of those the calling identity holds, which lets agents decide whether to attempt the operation or escalate.

### Can I limit what my agent is allowed to do with the Cloud Source Repositories API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. Since Cloud Source Repositories puts the repository in the URL path, such as /v1/{name} and /v1/{resource}:setIamPolicy, you can pin the agent to a single repo and allow only the calls it needs, for example creating, reading, and syncing that repo. Operations like setIamPolicy stay off limits unless you explicitly add them, so the agent cannot change access controls on its own.