Controlling who has access to an API is an integral part of development. For
example, as you test your API, you might want to automate redeploying updated
Cloud Endpoints configurations by using a service account that has the
permission to do so. By default, only the project owner can manage access to an
API. This page shows you how to grant and revoke access to your API by using the
Google Cloud console or the Google Cloud CLI.
Endpoints usesIdentity and Access Managementroles to grant and revoke access at the API level. You can grant and revoke
access to a user, service account, or to aGoogle Group.
Google Groups are a convenient way to grant or revoke access to a collection of
users. You can grant or revoke access for a whole group at once, instead of
granting or revoking access one at a time for individual users or service
accounts. You can also easily add members to and remove members from a
Google Group instead of granting or revoking the IAM role for
each member.
Granting access
Google Cloud console
In the Google Cloud console, go to theEndpoints > Servicespage
for your project.
If you have more than one API, click the name of the API.
If thePermissionsside panel isn't open, clickaddPermissions.
In theAdd membersbox, enter the email address of a user, service
account, or Google Group.
In theSelect a roledrop-down, clickService Management, and
select one of the following roles:
Service Consumer:This role contains the
permissions for a non-project member to view and enable the API in their
own project. If you have created aportalfor your
API, this role lets your API users access the portal.
Service Controller:This role contains the
permissions to make calls to thecheckandreportmethods in theService InfrastructureAPI during runtime.
Service Config Editor:This role contains the minimum permissions
that Service Management requires to deploy an Endpoints
configuration to an existing service.
Service Management Administrator:This role contains the
permissions in the Service Config Editor, Service Consumer, and Service
Controller roles, plus the permissions required to grant access to
this API by usinggcloudor the programmatic methods
described inGranting, changing, and revoking access to resources.
See theService Management API access controltopic for information about this role. Although the Google Cloud console allows you to select other roles,
those roles aren't useful for managing your API.
To add the member to the specified IAM role, clickAdd.
Repeat adding members and selecting the role, as needed.
The Service Management roles don't allow users to access theEndpoints>Servicespage in the Google Cloud console. If you want users to be
able access theEndpoints>Servicespage, you must grant them theProject Viewerrole or a higher role on the project. SeeGranting, changing,
and revoking access to resourcesfor details.
gcloud
Open Cloud Shell, or if you have the Google Cloud CLI installed, open a
terminal window.
Enter the applicablegcloudcommand:
If you are granting access to a user, run the following:
For the role, specify one of the following IAM roles:
roles/servicemanagement.configEditor: This role contains
the minimum permissions that Service Management requires to
deploy an Endpoints configuration to an existing
service.
roles/servicemanagement.admin: This role contains the
permissions inroles/servicemanagement.configEditor,roles/servicemanagement.serviceConsumer, androles/servicemanagement.serviceController, plus the
permissions required to grant access to this API by usinggcloudor the programmatic methods described inGranting,
changing, and revoking access to resources.
The Service Management roles don't allow users to access theEndpoints>Servicespage in the Google Cloud console. If you
want users to be able access theEndpoints>Servicespage, you
must grant them theProject Viewerrole or a higher role on the project. SeeGranting, changing,
and revoking access to resourcesfor details.
Revoking access
To revoke access to your API, remove the IAM role from the member
who previously had the role.
Google Cloud console
In the Google Cloud console, go to theEndpoints>Servicespage
for your project.
If you have more than one API, click the name of the API.
If thePermissionsside panel isn't open, clickaddPermissions.
Locate the member for whom you want to revoke access. You can either click
the applicableRolecard to see a list of members, or you can enter
a name or role in theSearch membersbox.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-10-24 UTC."],[],[]]
