Send feedback
Predefined IAM roles
This page
applies to Apigee and Apigee hybrid .
Predefined roles give granular access to specific Google Cloud resources. These roles are created and maintained by Google. Google automatically updates their permissions as necessary, such as when Google Cloud adds new features or services.
The following table lists all the predefined IAM roles for API hub:
API hub
IAM role
Granted permissions
Role
Permissions
Cloud API Hub Admin
Beta
(roles/apihub.admin )
Full access to all API hub resources.
apigee.projectorganizations.get
apihub.*
apihub.apiHubInstances.createapihub.apiHubInstances.deleteapihub.apiHubInstances.getapihub.apiHubInstances.listapihub.apiHubInstances.updateapihub.apiOperations.createapihub.apiOperations.deleteapihub.apiOperations.getapihub.apiOperations.listapihub.apiOperations.updateapihub.apis.createapihub.apis.createTagBindingapihub.apis.deleteapihub.apis.deleteTagBindingapihub.apis.getapihub.apis.listapihub.apis.listEffectiveTagsapihub.apis.listTagBindingsapihub.apis.updateapihub.attributes.createapihub.attributes.deleteapihub.attributes.getapihub.attributes.listapihub.attributes.updateapihub.curations.createapihub.curations.deleteapihub.curations.getapihub.curations.listapihub.curations.updateapihub.definitions.getapihub.definitions.listapihub.definitions.updateapihub.dependencies.createapihub.dependencies.deleteapihub.dependencies.getapihub.dependencies.listapihub.dependencies.updateapihub.deployments.createapihub.deployments.createTagBinding apihub.deployments.deleteapihub.deployments.deleteTagBinding apihub.deployments.getapihub.deployments.listapihub.deployments.listEffectiveTags apihub.deployments.listTagBindings apihub.deployments.updateapihub.discoveredApiObservations.get apihub.discoveredApiObservations.list apihub.discoveredApiOperations.get apihub.discoveredApiOperations.list apihub.externalApis.createapihub.externalApis.deleteapihub.externalApis.getapihub.externalApis.listapihub.externalApis.updateapihub.hostProjectRegistrations.create apihub.hostProjectRegistrations.delete apihub.hostProjectRegistrations.get apihub.hostProjectRegistrations.list apihub.hostProjectRegistrations.register apihub.llmEnablements.deregister apihub.llmEnablements.getapihub.llmEnablements.listapihub.llmEnablements.registerapihub.locations.collectApiData apihub.locations.getApiInsights apihub.locations.searchResources apihub.locations2.searchResources apihub.operations.cancelapihub.operations.deleteapihub.operations.getapihub.operations.listapihub.plugininstances.applyConfig apihub.plugininstances.createapihub.plugininstances.deleteapihub.plugininstances.disableapihub.plugininstances.enableapihub.plugininstances.executeapihub.plugininstances.getapihub.plugininstances.listapihub.plugininstances.managePluginInstanceSourceData apihub.plugininstances.updateapihub.plugins.createapihub.plugins.deleteapihub.plugins.disableapihub.plugins.enableapihub.plugins.getapihub.plugins.listapihub.runTimeProjectAttachments.attach apihub.runTimeProjectAttachments.create apihub.runTimeProjectAttachments.delete apihub.runTimeProjectAttachments.get apihub.runTimeProjectAttachments.list apihub.runTimeProjectAttachments.lookup apihub.specs.createapihub.specs.deleteapihub.specs.getapihub.specs.lintapihub.specs.listapihub.specs.updateapihub.styleGuides.getapihub.styleGuides.updateapihub.versions.createapihub.versions.deleteapihub.versions.getapihub.versions.listapihub.versions.update
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Insights Viewer
Beta
(roles/apihub.apiInsightsViewer )
View API hub insights dashboards.
apigee.projectorganizations.get
apihub.apiHubInstances.get
apihub.apiHubInstances.list
apihub.apis.get
apihub.apis.list
apihub.deployments.get
apihub.deployments.list
apihub.locations.getApiInsights
apihub.plugininstances.get
apihub.plugininstances.list
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list
Cloud API hub Attributes Admin
Beta
(roles/apihub.attributeAdmin )
Full access to all Cloud API hub attribute's resources.
apihub.attributes.*
apihub.attributes.createapihub.attributes.deleteapihub.attributes.getapihub.attributes.listapihub.attributes.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API Hub Editor
Beta
(roles/apihub.editor )
Edit access to most of Cloud API Hub resources.
apihub.apiHubInstances.get
apihub.apiHubInstances.list
apihub.apiOperations.*
apihub.apiOperations.createapihub.apiOperations.deleteapihub.apiOperations.getapihub.apiOperations.listapihub.apiOperations.update
apihub.apis.*
apihub.apis.createapihub.apis.createTagBindingapihub.apis.deleteapihub.apis.deleteTagBindingapihub.apis.getapihub.apis.listapihub.apis.listEffectiveTagsapihub.apis.listTagBindingsapihub.apis.update
apihub.attributes.get
apihub.attributes.list
apihub.curations.get
apihub.curations.list
apihub.definitions.*
apihub.definitions.getapihub.definitions.listapihub.definitions.update
apihub.dependencies.*
apihub.dependencies.createapihub.dependencies.deleteapihub.dependencies.getapihub.dependencies.listapihub.dependencies.update
apihub.deployments.*
apihub.deployments.createapihub.deployments.createTagBinding apihub.deployments.deleteapihub.deployments.deleteTagBinding apihub.deployments.getapihub.deployments.listapihub.deployments.listEffectiveTags apihub.deployments.listTagBindings apihub.deployments.update
apihub.discoveredApiObservations.*
apihub.discoveredApiObservations.get apihub.discoveredApiObservations.list
apihub.discoveredApiOperations.*
apihub.discoveredApiOperations.get apihub.discoveredApiOperations.list
apihub.externalApis.*
apihub.externalApis.createapihub.externalApis.deleteapihub.externalApis.getapihub.externalApis.listapihub.externalApis.update
apihub.hostProjectRegistrations.get
apihub.hostProjectRegistrations.list
apihub.llmEnablements.*
apihub.llmEnablements.deregister apihub.llmEnablements.getapihub.llmEnablements.listapihub.llmEnablements.register
apihub.locations.collectApiData
apihub.locations.searchResources
apihub.operations.get
apihub.operations.list
apihub.plugininstances.get
apihub.plugininstances.list
apihub.plugins.get
apihub.plugins.list
apihub.runTimeProjectAttachments.get
apihub.runTimeProjectAttachments.list
apihub.specs.*
apihub.specs.createapihub.specs.deleteapihub.specs.getapihub.specs.lintapihub.specs.listapihub.specs.update
apihub.styleGuides.get
apihub.versions.*
apihub.versions.createapihub.versions.deleteapihub.versions.getapihub.versions.listapihub.versions.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Plugins Admin
Beta
(roles/apihub.pluginAdmin )
Full access to all Cloud API hub plugin's resources.
apihub.curations.*
apihub.curations.createapihub.curations.deleteapihub.curations.getapihub.curations.listapihub.curations.update
apihub.locations.collectApiData
apihub.operations.*
apihub.operations.cancelapihub.operations.deleteapihub.operations.getapihub.operations.list
apihub.plugininstances.*
apihub.plugininstances.applyConfig apihub.plugininstances.createapihub.plugininstances.deleteapihub.plugininstances.disableapihub.plugininstances.enableapihub.plugininstances.executeapihub.plugininstances.getapihub.plugininstances.listapihub.plugininstances.managePluginInstanceSourceData apihub.plugininstances.update
apihub.plugins.*
apihub.plugins.createapihub.plugins.deleteapihub.plugins.disableapihub.plugins.enableapihub.plugins.getapihub.plugins.list
apihub.specs.lint
apihub.styleGuides.*
apihub.styleGuides.getapihub.styleGuides.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Provisioning Admin
Beta
(roles/apihub.provisioningAdmin )
Full access to Cloud API hub provisioning related resources.
apihub.apiHubInstances.*
apihub.apiHubInstances.createapihub.apiHubInstances.deleteapihub.apiHubInstances.getapihub.apiHubInstances.listapihub.apiHubInstances.update
apihub.hostProjectRegistrations.*
apihub.hostProjectRegistrations.create apihub.hostProjectRegistrations.delete apihub.hostProjectRegistrations.get apihub.hostProjectRegistrations.list apihub.hostProjectRegistrations.register
apihub.operations.*
apihub.operations.cancelapihub.operations.deleteapihub.operations.getapihub.operations.list
apihub.runTimeProjectAttachments.*
apihub.runTimeProjectAttachments.attach apihub.runTimeProjectAttachments.create apihub.runTimeProjectAttachments.delete apihub.runTimeProjectAttachments.get apihub.runTimeProjectAttachments.list apihub.runTimeProjectAttachments.lookup
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Runtime Project Attachment Editor
Beta
(roles/apihub.runTimeProjectAttachmentsEditor )
Access to add/delete project as a runtime project attachment to API hub host project.
apihub.runTimeProjectAttachments.attach
API-Hub Runtime Project Service Agent
(roles/apihub.runtimeProjectServiceAgent )
Gives API-Hub Service Account access to runtime project resources.
Warning: Do not grant service agent roles to any principals except
service agents .
apigee.deployments.list
apigee.envgroupattachments.list
apigee.envgroups.list
apigee.environments.get
apigee.organizations.create
apigee.organizations.delete
apigee.organizations.get
apigee.organizations.update
apigee.proxies.get
apigee.proxyrevisions.get
apihub.apiOperations.delete
apihub.apiOperations.list
apihub.apis.create
apihub.apis.delete
apihub.apis.list
apihub.apis.update
apihub.attributes.create
apihub.attributes.list
apihub.attributes.update
apihub.curations.list
apihub.definitions.list
apihub.dependencies.delete
apihub.dependencies.list
apihub.deployments.create
apihub.deployments.delete
apihub.deployments.list
apihub.deployments.update
apihub.externalApis.list
apihub.hostProjectRegistrations.list
apihub.operations.get
apihub.operations.list
apihub.plugininstances.create
apihub.plugininstances.delete
apihub.plugininstances.list
apihub.plugins.create
apihub.plugins.delete
apihub.plugins.list
apihub.runTimeProjectAttachments.list
apihub.specs.create
apihub.specs.delete
apihub.specs.list
apihub.specs.update
apihub.versions.create
apihub.versions.delete
apihub.versions.list
apihub.versions.update
Cloud API hub Viewer
Beta
(roles/apihub.viewer )
View access to all Cloud API hub resources.
apihub.apiHubInstances.get
apihub.apiHubInstances.list
apihub.apiOperations.get
apihub.apiOperations.list
apihub.apis.get
apihub.apis.list
apihub.apis.listEffectiveTags
apihub.apis.listTagBindings
apihub.attributes.get
apihub.attributes.list
apihub.curations.get
apihub.curations.list
apihub.definitions.get
apihub.definitions.list
apihub.dependencies.get
apihub.dependencies.list
apihub.deployments.get
apihub.deployments.list
apihub.deployments.listEffectiveTags
apihub.deployments.listTagBindings
apihub.discoveredApiObservations.*
apihub.discoveredApiObservations.get apihub.discoveredApiObservations.list
apihub.discoveredApiOperations.*
apihub.discoveredApiOperations.get apihub.discoveredApiOperations.list
apihub.externalApis.get
apihub.externalApis.list
apihub.hostProjectRegistrations.get
apihub.hostProjectRegistrations.list
apihub.llmEnablements.get
apihub.llmEnablements.list
apihub.locations.searchResources
apihub.operations.get
apihub.operations.list
apihub.plugininstances.get
apihub.plugininstances.list
apihub.plugins.get
apihub.plugins.list
apihub.runTimeProjectAttachments.get
apihub.runTimeProjectAttachments.list
apihub.specs.get
apihub.specs.list
apihub.styleGuides.get
apihub.versions.get
apihub.versions.list
resourcemanager.projects.get
resourcemanager.projects.list
For more information about predefined roles, see Roles and permissions . For help choosing the most appropriate predefined roles, see Choose predefined roles .
Send feedback
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License , and code samples are licensed under the Apache 2.0 License . For details, see the Google Developers Site Policies . Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-10-29 UTC.
Need to tell us more?
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-10-29 UTC."],[],[]]
