API Management roles and permissions

This page lists the IAM roles and permissions for API Management. To search through all roles and permissions, see the role and permission index.

API Management roles

Role Permissions

API Management Admin Beta

(roles/apim.admin)

Full access to API Management resources.

apim.*

  • apim.apiObservations.batchEditTags
  • apim.apiObservations.get
  • apim.apiObservations.list
  • apim.apiOperations.get
  • apim.apiOperations.list
  • apim.entitlements.get
  • apim.locations.get
  • apim.locations.list
  • apim.locations.listApiObservationTags
  • apim.observationJobs.create
  • apim.observationJobs.delete
  • apim.observationJobs.disable
  • apim.observationJobs.enable
  • apim.observationJobs.get
  • apim.observationJobs.list
  • apim.observationSources.create
  • apim.observationSources.delete
  • apim.observationSources.get
  • apim.observationSources.list
  • apim.operations.cancel
  • apim.operations.delete
  • apim.operations.get
  • apim.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

API Management Viewer Beta

(roles/apim.viewer)

Readonly access to API Management resources.

apim.apiObservations.get

apim.apiObservations.list

apim.apiOperations.*

  • apim.apiOperations.get
  • apim.apiOperations.list

apim.entitlements.get

apim.locations.*

  • apim.locations.get
  • apim.locations.list
  • apim.locations.listApiObservationTags

apim.observationJobs.get

apim.observationJobs.list

apim.observationSources.get

apim.observationSources.list

apim.operations.get

apim.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

APIM API Discovery Service Agent

(roles/apim.apiDiscoveryServiceAgent)

Gives APIM the ability to manage resources in consumer project

compute.backendServices.create

compute.backendServices.delete

compute.backendServices.get

compute.backendServices.list

compute.backendServices.update

compute.backendServices.use

compute.globalOperations.get

compute.networks.use

compute.regionBackendServices.create

compute.regionBackendServices.delete

compute.regionBackendServices.get

compute.regionBackendServices.list

compute.regionBackendServices.update

compute.regionBackendServices.use

compute.regionNetworkEndpointGroups.attachNetworkEndpoints

compute.regionNetworkEndpointGroups.create

compute.regionNetworkEndpointGroups.delete

compute.regionNetworkEndpointGroups.detachNetworkEndpoints

compute.regionNetworkEndpointGroups.get

compute.regionNetworkEndpointGroups.list

compute.regionNetworkEndpointGroups.use

compute.regionOperations.get

compute.subnetworks.use

networkservices.operations.*

  • networkservices.operations.cancel
  • networkservices.operations.delete
  • networkservices.operations.get
  • networkservices.operations.list

API Management permissions

Permission Included in roles

apim.apiObservations.batchEditTags

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.apiObservations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.apiObservations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

apim.apiOperations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.apiOperations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

apim.entitlements.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.locations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.locations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

apim.locations.listApiObservationTags

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.observationJobs.create

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.delete

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.disable

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.enable

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.observationJobs.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

apim.observationSources.create

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationSources.delete

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationSources.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.observationSources.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

apim.operations.cancel

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.operations.delete

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.operations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.operations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026年08月28日 UTC.