This page lists the IAM roles and permissions for API Gateway. To search through all roles and permissions, see the role and permission index .
API Gateway roles
ApiGateway Admin
( roles/
)
Full access to ApiGateway and related resources.
apigateway.*
-
apigateway.apiconfigs.create -
apigateway.apiconfigs.delete -
apigateway.apiconfigs.get -
apigateway.apiconfigs. getIamPolicy -
apigateway.apiconfigs.list -
apigateway.apiconfigs. setIamPolicy -
apigateway.apiconfigs.update -
apigateway.apis.create -
apigateway.apis. createTagBinding -
apigateway.apis.delete -
apigateway.apis. deleteTagBinding -
apigateway.apis.get -
apigateway.apis.getIamPolicy -
apigateway.apis.list -
apigateway.apis. listEffectiveTags -
apigateway.apis. listTagBindings -
apigateway.apis.setIamPolicy -
apigateway.apis.update -
apigateway.gateways.create -
apigateway.gateways. createTagBinding -
apigateway.gateways.delete -
apigateway.gateways. deleteTagBinding -
apigateway.gateways.get -
apigateway.gateways. getIamPolicy -
apigateway.gateways.list -
apigateway.gateways. listEffectiveTags -
apigateway.gateways. listTagBindings -
apigateway.gateways. setIamPolicy -
apigateway.gateways.update -
apigateway.locations.get -
apigateway.locations.list -
apigateway.operations.cancel -
apigateway.operations.delete -
apigateway.operations.get -
apigateway.operations.list
monitoring.
monitoring.
monitoring.timeSeries.list
resourcemanager.projects.get
resourcemanager.projects.list
servicemanagement.services.get
serviceusage.services.get
serviceusage.services.list
Cloud API Gateway Service Agent
( roles/
)
Gives Cloud API Gateway service account access to Service Management check and reports as well as impersonation on user-specified service accounts.
iam.
iam.
servicemanagement.
servicemanagement.
servicemanagement.
ApiGateway Viewer
( roles/
)
Read-only access to ApiGateway and related resources.
apigateway.apiconfigs.get
apigateway.
apigateway.apiconfigs.list
apigateway.apis.get
apigateway.apis.getIamPolicy
apigateway.apis.list
apigateway.
apigateway.
apigateway.gateways.get
apigateway.
apigateway.gateways.list
apigateway.
apigateway.
apigateway.locations.*
-
apigateway.locations.get -
apigateway.locations.list
apigateway.operations.get
apigateway.operations.list
monitoring.
monitoring.
monitoring.timeSeries.list
resourcemanager.projects.get
resourcemanager.projects.list
servicemanagement.services.get
serviceusage.services.get
serviceusage.services.list
Cloud API Gateway Management Service Agent
( roles/
)
Gives Cloud API Gateway service account access to retrieve a Service configuration.
iam.serviceAccounts.get
servicemanagement.
servicemanagement.
servicemanagement.services.get
servicemanagement.
servicemanagement.
serviceusage.services.get
API Gateway permissions
apigateway.apiconfigs.create
apigateway.apiconfigs.delete
apigateway.apiconfigs.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Service agent roles
- Attack Surface Management Scanner Service Agent
(
roles/)securitycenter.attackSurfaceManagementScannerServiceAgent
apigateway.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.apiconfigs.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.
Owner
( roles/
)
ApiGateway Admin
( roles/
)
Security Admin
( roles/
)
apigateway.apiconfigs.update
apigateway.apis.create
apigateway.
Owner
( roles/
)
ApiGateway Admin
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Tag User
( roles/
)
apigateway.apis.delete
apigateway.
Owner
( roles/
)
ApiGateway Admin
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Tag User
( roles/
)
apigateway.apis.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
apigateway.apis.getIamPolicy
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.apis.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
apigateway.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
apigateway.apis.setIamPolicy
Owner
( roles/
)
ApiGateway Admin
( roles/
)
Security Admin
( roles/
)
apigateway.apis.update
apigateway.gateways.create
apigateway.
Owner
( roles/
)
ApiGateway Admin
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Tag User
( roles/
)
apigateway.gateways.delete
apigateway.
Owner
( roles/
)
ApiGateway Admin
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Tag User
( roles/
)
apigateway.gateways.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
apigateway.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.gateways.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
apigateway.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
apigateway.
Owner
( roles/
)
ApiGateway Admin
( roles/
)
Security Admin
( roles/
)
apigateway.gateways.update
apigateway.locations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
apigateway.locations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
apigateway.operations.cancel
apigateway.operations.delete
apigateway.operations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
apigateway.operations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
ApiGateway Admin
( roles/
)
ApiGateway Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
