# Cloud Identity API API

> Cloud Identity API API on Apizie: 41 endpoints (Lists the domains in the allowlist., Adds a domain to the allowlist., Get a policy., Update a policy., …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `analytics:googleapis-cloudidentity`
- Category: Analytics
- Status: byok
- Source: https://cloud.google.com/identity/
- Page: https://zieapi.vercel.app/api/analytics/googleapis-cloudidentity
- OpenAPI: https://zieapi.vercel.app/api/analytics/googleapis-cloudidentity/openapi.json

API for provisioning and managing identity resources.

## Endpoints

### Lists the domains in the allowlist.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-allowlisted-domains-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. Provides an optional filter for list results. Currently, only exact matches on the domain are supported, such as "domain =… |
| pageSize | integer | no | Optional. Specifies the requested page size. If unspecified, the service returns at most 5000 domains. The maximum value is 5000; values… |
| pageToken | string | no | Optional. Identifies a token from a previous page of results, if any. |

### Adds a domain to the allowlist.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-allowlisted-domains-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| body | object | yes | JSON request body |

### Get a policy.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-policies-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. The name of the policy to retrieve. Format: `policies/{policy}`. |

### Update a policy.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-policies-patch` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Output only. Identifier. The [resource name](https://cloud.google.com/apis/design/resource_names) of the Policy. Format: policies/{policy}. |
| body | object | yes | JSON request body |

### Delete a policy.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-policies-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. The name of the policy to delete. Format: `policies/{policy}`. |

### Cancels a UserInvitation that was already sent.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-customers-userinvitations-cancel` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. `UserInvitation` name in the format `customers/{customer}/userinvitations/{user_email_address}` |
| body | object | yes | JSON request body |

### Verifies whether a user account is eligible to receive a UserInvitation (is an unmanaged account).…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-customers-userinvitations-is-invitable-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. `UserInvitation` name in the format `customers/{customer}/userinvitations/{user_email_address}` |

### Retrieves a list of UserInvitation resources. **Note:** New consumer accounts with the customer's verified…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-customers-userinvitations-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. A query string for filtering `UserInvitation` results by their current state, in the format: `"state=='invited'"`. |
| orderBy | string | no | Optional. The sort order of the list results. You can sort the results in descending order based on either email or last update timestamp… |
| pageSize | integer | no | Optional. The maximum number of UserInvitation resources to return. If unspecified, at most 100 resources will be returned. The maximum… |
| pageToken | string | no | Optional. A page token, received from a previous `ListUserInvitations` call. Provide this to retrieve the subsequent page. When… |
| parent | string | yes | Required. The customer ID of the Google Workspace or Cloud Identity account the UserInvitation resources are associated with. |

### Sends a UserInvitation to email. If the `UserInvitation` does not exist for this request and it is a valid…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-customers-userinvitations-send` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. `UserInvitation` name in the format `customers/{customer}/userinvitations/{user_email_address}` |
| body | object | yes | JSON request body |

### Cancels an unfinished user account wipe. This operation can be used to cancel device wipe in the gap between…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-cancel-wipe` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. [Resource name](https://cloud.google.com/apis/design/resource_names) of the Device in format:… |
| body | object | yes | JSON request body |

### Lists/Searches devices.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| customer | string | no | Optional. [Resource name](https://cloud.google.com/apis/design/resource_names) of the customer in the format: `customers/{customer}`,… |
| filter | string | no | Optional. Additional restrictions when fetching list of devices. For a list of search fields, refer to [Mobile device search… |
| orderBy | string | no | Optional. Order specification for devices in the response. Only one of the following field names may be used to specify the order:… |
| pageSize | integer | no | Optional. The maximum number of Devices to return. If unspecified, at most 20 Devices will be returned. The maximum value is 100; values… |
| pageToken | string | no | Optional. A page token, received from a previous `ListDevices` call. Provide this to retrieve the subsequent page. When paginating, all… |
| view | string | no | Optional. The view to use for the List request. |

### Creates a device. Only company-owned device may be created. **Note**: This method is available only to…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| customer | string | no | Optional. [Resource name](https://cloud.google.com/apis/design/resource_names) of the customer. If you're using this API for your own… |
| body | object | yes | JSON request body |

### Wipes the user's account on a device. Other data on the device that is not associated with the user's work…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-wipe` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. [Resource name](https://cloud.google.com/apis/design/resource_names) of the Device in format:… |
| body | object | yes | JSON request body |

### Approves device to access user data.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-approve` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. [Resource name](https://cloud.google.com/apis/design/resource_names) of the Device in format:… |
| body | object | yes | JSON request body |

### Blocks device from accessing user data
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-block` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. [Resource name](https://cloud.google.com/apis/design/resource_names) of the Device in format:… |
| body | object | yes | JSON request body |

### Lists/Searches DeviceUsers.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| customer | string | no | Optional. [Resource name](https://cloud.google.com/apis/design/resource_names) of the customer. If you're using this API for your own… |
| filter | string | no | Optional. Additional restrictions when fetching list of devices. For a list of search fields, refer to [Mobile device search… |
| orderBy | string | no | Optional. Order specification for devices in the response. |
| pageSize | integer | no | Optional. The maximum number of DeviceUsers to return. If unspecified, at most 5 DeviceUsers will be returned. The maximum value is 20;… |
| pageToken | string | no | Optional. A page token, received from a previous `ListDeviceUsers` call. Provide this to retrieve the subsequent page. When paginating,… |
| parent | string | yes | Required. To list all DeviceUsers, set this to "devices/-". To list all DeviceUsers owned by a device, set this to the resource name of… |

### Looks up resource names of the DeviceUsers associated with the caller's credentials, as well as the…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-lookup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| androidId | string | no | Android Id returned by… |
| iosDeviceId | string | no | Optional. The partner-specified device identifier assigned to the iOS device that initiated the Lookup API call. This string must match… |
| pageSize | integer | no | The maximum number of DeviceUsers to return. If unspecified, at most 20 DeviceUsers will be returned. The maximum value is 20; values… |
| pageToken | string | no | A page token, received from a previous `LookupDeviceUsers` call. Provide this to retrieve the subsequent page. When paginating, all other… |
| parent | string | yes | Must be set to "devices/-/deviceUsers" to search across all DeviceUser belonging to the user. |
| partner | string | no | Optional. The partner ID of the calling iOS app. This string must match the value of the partner key within the app configuration… |
| rawResourceId | string | no | Raw Resource Id used by Google Endpoint Verification. If the user is enrolled into Google Endpoint Verification, this id will be saved as… |
| userId | string | no | The user whose DeviceUser's resource name will be fetched. Must be set to 'me' to fetch the DeviceUser's resource name for the calling user. |

### Lists the client states for the given search query.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-devices-device-users-client-states-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| customer | string | no | Optional. [Resource name](https://cloud.google.com/apis/design/resource_names) of the customer. If you're using this API for your own… |
| filter | string | no | Optional. Additional restrictions when fetching list of client states. |
| orderBy | string | no | Optional. Order specification for client states in the response. |
| pageToken | string | no | Optional. A page token, received from a previous `ListClientStates` call. Provide this to retrieve the subsequent page. When paginating,… |
| parent | string | yes | Required. To list all ClientStates, set this to "devices/-/deviceUsers/-". To list all ClientStates owned by a DeviceUser, set this to the… |

### Lists the `Group` resources under a customer or namespace.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The maximum number of results to return. Note that the number of results returned may be less than this value even if there are more… |
| pageToken | string | no | The `next_page_token` value returned from a previous list request, if any. |
| parent | string | no | Required. The parent resource under which to list all `Group` resources. Must be of the form `identitysources/{identity_source}` for… |
| view | string | no | The level of detail to be returned. If unspecified, defaults to `View.BASIC`. |

### Creates a Group.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| initialGroupConfig | string | no | Optional. The initial configuration option for the `Group`. |
| body | object | yes | JSON request body |

### Looks up the [resource name](https://cloud.google.com/apis/design/resource_names) of a `Group` by its…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-lookup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| groupKey.id | string | no | The ID of the entity. For Google-managed entities, the `id` should be the email address of an existing group or user. Email addresses need… |
| groupKey.namespace | string | no | The namespace in which the entity exists. If not specified, the `EntityKey` represents a Google-managed entity such as a Google user or a… |

### Searches for `Group` resources matching a specified query.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-search` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The maximum number of results to return. Note that the number of results returned may be less than this value even if there are more… |
| pageToken | string | no | The `next_page_token` value returned from a previous search request, if any. |
| query | string | no | Required. The search query. * Must be specified in [Common Expression Language](https://opensource.google/projects/cel). See [CEL… |
| view | string | no | The level of detail to be returned. If unspecified, defaults to `View.BASIC`. |

### Check a potential member for membership in a group. **Note:** This feature is only available to Google…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-check-transitive-membership` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | [Resource name](https://cloud.google.com/apis/design/resource_names) of the group to check the transitive membership in. Format:… |
| query | string | no | Required. A CEL expression that MUST include member specification. This is a `required` field. Certain groups are uniquely identified by… |

### Lists the `Membership`s within a `Group`.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The maximum number of results to return. Note that the number of results returned may be less than this value even if there are more… |
| pageToken | string | no | The `next_page_token` value returned from a previous search request, if any. |
| parent | string | yes | Required. The parent `Group` resource under which to lookup the `Membership` name. Must be of the form `groups/{group}`. |
| view | string | no | The level of detail to be returned. If unspecified, defaults to `View.BASIC`. |

### Creates a `Membership`.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. The parent `Group` resource under which to create the `Membership`. Must be of the form `groups/{group}`. |
| body | object | yes | JSON request body |

### Get a membership graph of just a member or both a member and a group. **Note:** This feature is only…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-get-membership-graph` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. [Resource name](https://cloud.google.com/apis/design/resource_names) of the group to search transitive memberships in. Format:… |
| query | string | no | Required. A CEL expression that MUST include member specification AND label(s). Certain groups are uniquely identified by both a… |

### Looks up the [resource name](https://cloud.google.com/apis/design/resource_names) of a `Membership` by its…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-lookup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| memberKey.id | string | no | The ID of the entity. For Google-managed entities, the `id` should be the email address of an existing group or user. Email addresses need… |
| memberKey.namespace | string | no | The namespace in which the entity exists. If not specified, the `EntityKey` represents a Google-managed entity such as a Google user or a… |
| parent | string | yes | Required. The parent `Group` resource under which to lookup the `Membership` name. Must be of the form `groups/{group}`. |

### Modifies the `MembershipRole`s of a `Membership`.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-modify-membership-roles` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. The [resource name](https://cloud.google.com/apis/design/resource_names) of the `Membership` whose roles are to be modified.… |
| body | object | yes | JSON request body |

### Searches direct groups of a member. Groups for which the actor does not have the permission to view…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-search-direct-groups` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| orderBy | string | no | The ordering of membership relation for the display name or email in the response. The syntax for this field can be found at… |
| pageSize | integer | no | The default page size is 200 (max 1000). |
| pageToken | string | no | The `next_page_token` value returned from a previous list request, if any |
| parent | string | yes | [Resource name](https://cloud.google.com/apis/design/resource_names) of the group to search transitive memberships in. Format:… |
| query | string | no | Required. A CEL expression that MUST include member specification AND label(s). Users can search on label attributes of groups. CONTAINS… |

### Search transitive groups of a member. **Note:** This feature is only available to Google Workspace…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-search-transitive-groups` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The default page size is 200 (max 1000). |
| pageToken | string | no | The `next_page_token` value returned from a previous list request, if any. |
| parent | string | yes | [Resource name](https://cloud.google.com/apis/design/resource_names) of the group to search transitive memberships in. Format:… |
| query | string | no | Required. A CEL expression that MUST include member specification AND label(s). This is a `required` field. Users can search on label… |

### Search transitive memberships of a group. **Note:** This feature is only available to Google Workspace…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-groups-memberships-search-transitive-membershi` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The default page size is 200 (max 1000). |
| pageToken | string | no | The `next_page_token` value returned from a previous list request, if any. |
| parent | string | yes | [Resource name](https://cloud.google.com/apis/design/resource_names) of the group to search transitive memberships in. Format:… |

### Lists InboundOidcSsoProfile objects for a Google enterprise customer.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-oidc-sso-profiles-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | A [Common Expression Language](https://github.com/google/cel-spec) expression to filter the results. The only supported filter is… |
| pageSize | integer | no | The maximum number of InboundOidcSsoProfiles to return. The service may return fewer than this value. If omitted (or defaulted to zero)… |
| pageToken | string | no | A page token, received from a previous `ListInboundOidcSsoProfiles` call. Provide this to retrieve the subsequent page. When paginating,… |

### Creates an InboundOidcSsoProfile for a customer. When the target customer has enabled [Multi-party approval…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-oidc-sso-profiles-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| body | object | yes | JSON request body |

### Lists InboundSamlSsoProfiles for a customer.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-saml-sso-profiles-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | A [Common Expression Language](https://github.com/google/cel-spec) expression to filter the results. The only supported filter is… |
| pageSize | integer | no | The maximum number of InboundSamlSsoProfiles to return. The service may return fewer than this value. If omitted (or defaulted to zero)… |
| pageToken | string | no | A page token, received from a previous `ListInboundSamlSsoProfiles` call. Provide this to retrieve the subsequent page. When paginating,… |

### Creates an InboundSamlSsoProfile for a customer. When the target customer has enabled [Multi-party approval…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-saml-sso-profiles-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| body | object | yes | JSON request body |

### Adds an IdpCredential. Up to 2 credentials are allowed. When the target customer has enabled [Multi-party…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-saml-sso-profiles-idp-credentials-add` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. The InboundSamlSsoProfile that owns the IdpCredential. Format: `inboundSamlSsoProfiles/{sso_profile_id}` |
| body | object | yes | JSON request body |

### Returns a list of IdpCredentials in an InboundSamlSsoProfile.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-saml-sso-profiles-idp-credentials-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The maximum number of `IdpCredential`s to return. The service may return fewer than this value. |
| pageToken | string | no | A page token, received from a previous `ListIdpCredentials` call. Provide this to retrieve the subsequent page. When paginating, all other… |
| parent | string | yes | Required. The parent, which owns this collection of `IdpCredential`s. Format: `inboundSamlSsoProfiles/{sso_profile_id}` |

### Lists the InboundSsoAssignments for a `Customer`.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-sso-assignments-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | A CEL expression to filter the results. The only supported filter is filtering by customer. For example: `customer==customers/C0123abc`.… |
| pageSize | integer | no | The maximum number of assignments to return. The service may return fewer than this value. If omitted (or defaulted to zero) the server… |
| pageToken | string | no | A page token, received from a previous `ListInboundSsoAssignments` call. Provide this to retrieve the subsequent page. When paginating,… |

### Creates an InboundSsoAssignment for users and devices in a `Customer` under a given `Group` or `OrgUnit`.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-inbound-sso-assignments-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| body | object | yes | JSON request body |

### List policies.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-policies-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. A CEL expression for filtering the results. Policies can be filtered using the expression in the following ways: - Filter by… |
| pageSize | integer | no | Optional. The maximum number of results to return. The service can return fewer than this number. If omitted or set to `0`, the default is… |
| pageToken | string | no | Optional. The pagination token received from a prior call to PoliciesService.ListPolicies to retrieve the next page of results. When… |

### Create a policy.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-policies-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| body | object | yes | JSON request body |

## Example
```
curl "https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-allowlisted-domains-list" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Cloud Identity API API?
Create a free Apizie key, then send GET https://zieapi.vercel.app/v1/analytics:googleapis-cloudidentity/cloudidentity-allowlisted-domains-list with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Cloud Identity API API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Cloud Identity API itself also needs your own key from googleapis.com.

### Can AI agents use the Cloud Identity API API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key analytics:googleapis-cloudidentity.

### What is the status of the Cloud Identity API API?
Needs your own provider key (bring your own key)