# Cloud Identity-Aware Proxy API API

> Cloud Identity-Aware Proxy API API on Apizie: 16 endpoints (Lists the existing brands for the project., Constructs a new OAuth brand for the project if one does not exist. The created brand is "internal only",…, Retrieves an existing TunnelDestGroup., Updates a TunnelDestGroup., …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/analytics:googleapis-iap/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `analytics:googleapis-iap`
- Category: Analytics
- Status: byok
- Source: https://cloud.google.com/iap
- Page: https://zieapi.vercel.app/api/analytics/googleapis-iap
- OpenAPI: https://zieapi.vercel.app/api/analytics/googleapis-iap/openapi.json

Controls access to cloud applications running on Google Cloud Platform.

## Endpoints

### Lists the existing brands for the project.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. GCP Project number/id. In the following format: projects/{project_number/id}. |

### Constructs a new OAuth brand for the project if one does not exist. The created brand is "internal only",…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. GCP Project number/id under which the brand is to be created. In the following format: projects/{project_number/id}. |
| body | object | yes | JSON request body |

### Retrieves an existing TunnelDestGroup.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-iap-tunnel-locations-dest-groups-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the TunnelDestGroup to be fetched. In the following format:… |

### Updates a TunnelDestGroup.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-iap-tunnel-locations-dest-groups-patch` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Identifier. Identifier for the TunnelDestGroup. Must be unique within the project and contain only lower case letters (a-z) and dashes (-). |
| updateMask | string | no | A field mask that specifies which IAP settings to update. If omitted, then all of the settings are updated. See… |
| body | object | yes | JSON request body |

### Deletes a TunnelDestGroup.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-iap-tunnel-locations-dest-groups-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the TunnelDestGroup to delete. In the following format:… |

### Lists the existing clients for the brand.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-identity-aware-proxy-clients-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The maximum number of clients to return. The service may return fewer than this value. If unspecified, at most 100 clients will be… |
| pageToken | string | no | A page token, received from a previous `ListIdentityAwareProxyClients` call. Provide this to retrieve the subsequent page. When… |
| parent | string | yes | Required. Full brand path. In the following format: projects/{project_number/id}/brands/{brand}. |

### Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned by IAP. Requires that the brand for…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-identity-aware-proxy-clients-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. Path to create the client in. In the following format: projects/{project_number/id}/brands/{brand}. The project must belong to a… |
| body | object | yes | JSON request body |

### Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the secret was compromised. Requires…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-identity-aware-proxy-clients-reset-secre` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the Identity Aware Proxy client to that will have its secret reset. In the following format:… |
| body | object | yes | JSON request body |

### Lists the existing TunnelDestGroups. To group across all locations, use a `-` as the location ID. For…
`GET https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-iap-tunnel-locations-dest-groups-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| pageSize | integer | no | The maximum number of groups to return. The service might return fewer than this value. If unspecified, at most 100 groups are returned.… |
| pageToken | string | no | A page token, received from a previous `ListTunnelDestGroups` call. Provide this to retrieve the subsequent page. When paginating, all… |
| parent | string | yes | Required. Google Cloud Project ID and location. In the following format: `projects/{project_number/id}/iap_tunnel/locations/{location}`. A… |

### Creates a new TunnelDestGroup.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-iap-tunnel-locations-dest-groups-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. Google Cloud Project ID and location. In the following format: `projects/{project_number/id}/iap_tunnel/locations/{location}`. |
| tunnelDestGroupId | string | no | Required. The ID to use for the TunnelDestGroup, which becomes the final component of the resource name. This value must be 4-63… |
| body | object | yes | JSON request body |

### Gets the access control policy for an Identity-Aware Proxy protected resource. More information about…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-get-iam-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| resource | string | yes | REQUIRED: The resource for which the policy is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names)… |
| body | object | yes | JSON request body |

### Gets the IAP settings on a particular IAP protected resource.
`GET https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-get-iap-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. The resource name for which to retrieve the settings. Authorization: Requires the `getSettings` permission for the associated… |

### Updates the IAP settings on a particular IAP protected resource. It replaces all fields unless the…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-update-iap-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. The resource name of the IAP protected resource. |
| updateMask | string | no | The field mask specifying which IAP settings should be updated. If omitted, then all of the settings are updated. See… |
| body | object | yes | JSON request body |

### Sets the access control policy for an Identity-Aware Proxy protected resource. Replaces any existing policy.…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-set-iam-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| resource | string | yes | REQUIRED: The resource for which the policy is being specified. See [Resource names](https://cloud.google.com/apis/design/resource_names)… |
| body | object | yes | JSON request body |

### Returns permissions that a caller has on the Identity-Aware Proxy protected resource. More information about…
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-test-iam-permissions` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| resource | string | yes | REQUIRED: The resource for which the policy detail is being requested. See [Resource… |
| body | object | yes | JSON request body |

### Validates that a given CEL expression conforms to IAP restrictions.
`POST https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-validate-attribute-expression` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| expression | string | no | Required. User input string expression. Should be of the form `attributes.saml_attributes.filter(attribute, attribute.name in… |
| name | string | yes | Required. The resource name of the IAP protected resource. |

## Example
```
curl "https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-list" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Cloud Identity-Aware Proxy API API?
Create a free Apizie key, then send GET https://zieapi.vercel.app/v1/analytics:googleapis-iap/iap-projects-brands-list with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Cloud Identity-Aware Proxy API API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Cloud Identity-Aware Proxy API itself also needs your own key from googleapis.com.

### Can AI agents use the Cloud Identity-Aware Proxy API API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key analytics:googleapis-iap.

### What is the status of the Cloud Identity-Aware Proxy API API?
Needs your own provider key (bring your own key)