Identity and Access Management (IAM) API
Identity and Access Management (IAM) API
Google Cloud IAM API manages access control for GCP resources — service accounts, roles, policies, conditional access.
Fine-grained permission model (resource × role × principal)
Many roles and permissions — steep learning curve
POST /v1/projects/{projectId}/serviceAccounts to create a service account; POST /v1/{resource}:setIamPolicy to set the IAM policy.
Uptime · 30-day window
About this API
IAM is GCP's access-control core. Its model is the "principal → role → resource" triple — principal is user/serviceAccount/group/domain, role is a set of permissions (predefined like roles/storage.admin or custom), resource is a GCP resource (project/bucket/instance, etc.). A key feature is conditional access — add conditions like "during business hours only", "from corporate IPs only", "only on resources with a specific tag". Service Account is machine identity (for apps, CI, cron), with keys or STS short-lived tokens. IAM API is mainly used for: automated CI/CD permission setup (instead of manual console clicks), compliance audits (export policies for inspection), and large-scale permission management (bulk revoke for departing employees).
What you can build
- 1Programmatically create service accounts
- 2Bulk-assign/revoke IAM roles
- 3Audit IAM policies
- 4Least-privilege configuration for CI/CD pipelines
Strengths & limitations
Strengths
- Fine-grained permission model (resource × role × principal)
- Conditional access (attribute-based access control) supported
- Complete and traceable audit logs
Limitations
- Many roles and permissions — steep learning curve
- Some resources still use legacy ACLs outside IAM
Example request
curl https://google.com/<endpoint>Getting started
POST /v1/projects/{projectId}/serviceAccounts to create a service account; POST /v1/{resource}:setIamPolicy to set the IAM policy.
FAQ
Are service account keys safe?+
Keys are long-lived credentials — high leak risk. Strongly recommend Workload Identity Federation (short-lived tokens, no keys) instead.
Predefined vs custom roles?+
Start with predefined; only customize if too broad. Custom roles have high maintenance cost (manual permission additions when GCP adds features).
Technical details
- Auth type
- unknown
- Pricing
- unknown
- Protocols
- REST
- SDKs
- python, javascript, go, java, csharp
- Last health check
- 5/12/2026, 7:37:35 AM
More from Google
Google Workspace Admin SDK API programmatically manages Workspace organizations — users, groups, devices, domains, audit logs, organizational units.
Retrieve AdMob accounts, apps, ad units, ad sources, and generate mediation or network reports.
Work with AdSense Host accounts, ad clients, ad units, reports, and ad code generation from one API surface.
Programmatically manage Apigee organizations, API proxy deployments, attributes, certificates, and hybrid operations.
Google BigQuery API is the REST interface to GCP's flagship data warehouse — execute SQL queries, manage datasets/tables, stream inserts, and use built-in ML.
Control Binary Authorization attestors and policy checks for container images deployed to GKE and Anthos.
Fetch Business Profile location metrics, daily time series, and monthly search keyword impressions.
Google Calendar API lets apps create, read, and update calendar events programmatically — the go-to integration for scheduling apps.