API Management roles and permissions

This page lists the IAM roles and permissions for API Management. Tosearch through all roles and permissions, see therole andpermission index.

API Management roles

RolePermissions

API Management AdminBeta

(roles/apim.admin)

Full access to API Management resources.

apim.*

  • apim.apiObservations.batchEditTags
  • apim.apiObservations.get
  • apim.apiObservations.list
  • apim.apiOperations.get
  • apim.apiOperations.list
  • apim.entitlements.get
  • apim.locations.get
  • apim.locations.list
  • apim.locations.listApiObservationTags
  • apim.observationJobs.create
  • apim.observationJobs.delete
  • apim.observationJobs.disable
  • apim.observationJobs.enable
  • apim.observationJobs.get
  • apim.observationJobs.list
  • apim.observationSources.create
  • apim.observationSources.delete
  • apim.observationSources.get
  • apim.observationSources.list
  • apim.operations.cancel
  • apim.operations.delete
  • apim.operations.get
  • apim.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

APIM API Discovery Service Agent

(roles/apim.apiDiscoveryServiceAgent)

Gives APIM the ability to manage resources in consumer project

Warning: Do not grant service agent roles to any principals exceptservice agents.

compute.backendServices.create

compute.backendServices.delete

compute.backendServices.get

compute.backendServices.list

compute.backendServices.update

compute.backendServices.use

compute.globalOperations.get

compute.networks.use

compute.regionBackendServices.create

compute.regionBackendServices.delete

compute.regionBackendServices.get

compute.regionBackendServices.list

compute.regionBackendServices.update

compute.regionBackendServices.use

compute.regionNetworkEndpointGroups.attachNetworkEndpoints

compute.regionNetworkEndpointGroups.create

compute.regionNetworkEndpointGroups.delete

compute.regionNetworkEndpointGroups.detachNetworkEndpoints

compute.regionNetworkEndpointGroups.get

compute.regionNetworkEndpointGroups.list

compute.regionNetworkEndpointGroups.use

compute.regionOperations.get

compute.subnetworks.use

networkservices.operations.*

  • networkservices.operations.cancel
  • networkservices.operations.delete
  • networkservices.operations.get
  • networkservices.operations.list

API Management ViewerBeta

(roles/apim.viewer)

Readonly access to API Management resources.

apim.apiObservations.get

apim.apiObservations.list

apim.apiOperations.*

  • apim.apiOperations.get
  • apim.apiOperations.list

apim.entitlements.get

apim.locations.*

  • apim.locations.get
  • apim.locations.list
  • apim.locations.listApiObservationTags

apim.observationJobs.get

apim.observationJobs.list

apim.observationSources.get

apim.observationSources.list

apim.operations.get

apim.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

API Management permissions

PermissionIncluded in roles

apim.apiObservations.batchEditTags

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.apiObservations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.apiObservations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

apim.apiOperations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.apiOperations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

apim.entitlements.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.locations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.locations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

apim.locations.listApiObservationTags

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.observationJobs.create

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.delete

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.disable

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.enable

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationJobs.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.observationJobs.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

apim.observationSources.create

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationSources.delete

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.observationSources.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.observationSources.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

apim.operations.cancel

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.operations.delete

Owner (roles/owner)

Editor (roles/editor)

API Management Admin (roles/apim.admin)

apim.operations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Support User (roles/iam.supportUser)

apim.operations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

API Management Admin (roles/apim.admin)

API Management Viewer (roles/apim.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.