Mengontrol siapa saja yang memiliki akses ke API adalah bagian integral dari pengembangan. Misalnya, saat menguji API, Anda mungkin ingin mengotomatiskan deployment ulang konfigurasi Cloud Endpoints yang diperbarui menggunakan akun layanan yang memiliki izin untuk melakukannya. Secara default, hanya pemilik project yang dapat mengelola akses ke API. Halaman ini menunjukkan cara memberikan dan mencabut akses ke API menggunakan konsolGoogle Cloud atau Google Cloud CLI.
Endpoint menggunakan peran Identity and Access Management untuk memberikan dan mencabut akses di tingkat API. Anda dapat memberikan dan mencabut akses ke pengguna, akun layanan, atau Grup Google.
Grup Google merupakan cara mudah untuk memberikan atau mencabut akses ke kumpulan
pengguna. Anda dapat memberikan atau mencabut akses untuk seluruh grup sekaligus, bukan
memberikan atau mencabut akses satu per satu untuk setiap pengguna atau akun
layanan. Anda juga dapat dengan mudah menambahkan anggota ke grup Google dan menghapus anggota
dari Grup Google, bukan memberikan atau mencabut peran IAM untuk
setiap anggota.
Memberikan akses
Google Cloud console
Di Google Cloud console, buka halaman Endpoints > Services
untuk project Anda.
Jika Anda memiliki lebih dari satu API, klik nama API tersebut.
Jika panel samping Izin tidak terbuka, klik addIzin.
Di kotak Tambahkan anggota, masukkan alamat email pengguna, akun layanan, atau Grup Google.
Di drop-down Select a role, klik Service Management, lalu
pilih salah satu peran berikut:
Service Consumer: Peran ini berisi izin bagi anggota non-project untuk melihat dan mengaktifkan API di project mereka sendiri. Jika Anda telah membuat
portal untuk
API, peran ini memungkinkan pengguna API mengakses portal.
Service Controller: Peran ini berisi
izin untuk melakukan panggilan ke metode check dan
report di
Service Infrastructure
API selama runtime.
Service Config Editor: Peran ini berisi izin minimum
yang diperlukan Pengelolaan Layanan untuk men-deploy konfigurasi Endpoint
ke layanan yang ada.
Administrator Pengelolaan Layanan: Peran ini berisi izin dalam peran Service Config Editor, Service Consumer, dan Service Controller, serta izin yang diperlukan untuk memberikan akses ke API ini menggunakan gcloud atau metode terprogram yang dijelaskan dalam
Pemberian, perubahan, dan pencabutan akses ke resource.
Lihat topik Kontrol akses Service Management API
untuk mengetahui informasi tentang peran ini. Meskipun konsol Google Cloud memungkinkan Anda memilih peran lain,
peran tersebut tidak berguna untuk mengelola API Anda.
Untuk menambahkan anggota ke peran IAM yang ditentukan, klik Tambahkan.
Ulangi penambahan anggota dan pemilihan peran, sesuai kebutuhan.
Peran Pengelolaan Layanan tidak mengizinkan pengguna mengakses halaman Endpoints >
Services di Google Cloud konsol. Jika Anda ingin pengguna dapat mengakses halaman Endpoints > Services, Anda harus memberi mereka peran Project Viewer atau peran yang lebih tinggi di project. Lihat
Memberikan, mengubah,
dan mencabut akses ke resource untuk mengetahui detailnya.
gcloud
Buka Cloud Shell, atau jika Anda telah menginstal Google Cloud CLI, buka jendela terminal.
Masukkan perintah gcloud yang berlaku:
Jika Anda memberikan akses kepada pengguna, jalankan perintah berikut:
Untuk peran, tentukan salah satu peran IAM berikut:
roles/servicemanagement.configEditor: Peran ini berisi izin minimum yang diperlukan Pengelolaan Layanan untuk men-deploy konfigurasi Endpoint ke layanan yang ada.
roles/servicemanagement.admin: Peran ini berisi izin di roles/servicemanagement.configEditor, roles/servicemanagement.serviceConsumer, dan roles/servicemanagement.serviceController, serta izin yang diperlukan untuk memberikan akses ke API ini menggunakan gcloud atau metode terprogram yang dijelaskan dalam Memberikan, mengubah, dan mencabut akses ke resource.
Peran Pengelolaan Layanan tidak mengizinkan pengguna mengakses halaman
Endpoints > Services di konsol Google Cloud . Jika ingin pengguna dapat mengakses halaman Endpoints > Services, Anda harus memberi mereka peran Project Viewer atau peran yang lebih tinggi di project. Lihat
Memberikan, mengubah,
dan mencabut akses ke resource untuk mengetahui detailnya.
Mencabut akses
Untuk mencabut akses ke API Anda, hapus peran IAM dari anggota
yang sebelumnya memiliki peran tersebut.
Google Cloud console
Di Google Cloud console, buka halaman Endpoints > Services
untuk project Anda.
Jika Anda memiliki lebih dari satu API, klik nama API tersebut.
Jika panel samping Izin tidak terbuka, klik addIzin.
Cari anggota yang aksesnya ingin Anda cabut. Anda dapat mengklik kartu Peran yang berlaku untuk melihat daftar anggota, atau memasukkan nama atau peran di kotak Telusuri anggota.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eThis document details how to manage API access using Google Cloud Endpoints, emphasizing the importance of controlling who can interact with your API.\u003c/p\u003e\n"],["\u003cp\u003eAccess to an API can be granted or revoked for individual users, service accounts, or Google Groups via Identity and Access Management (IAM) roles.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud console and the Google Cloud CLI (\u003ccode\u003egcloud\u003c/code\u003e) are the tools that are provided for managing API access, which includes various Service Management roles to configure specific permission levels.\u003c/p\u003e\n"],["\u003cp\u003eRevoking access involves removing the assigned IAM role from the user, service account, or Google Group, through either the Google Cloud console or the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"],["\u003cp\u003eUsers may require the "Project Viewer" role, in addition to the Service Management roles, in order to view the "Endpoints > Services" page on the Google Cloud console.\u003c/p\u003e\n"]]],[],null,["# Granting and revoking access to the API\n\n[OpenAPI](/endpoints/docs/openapi/control-api-access \"View this page for the Cloud Endpoints OpenAPI docs\") \\| gRPC\n\n\u003cbr /\u003e\n\nControlling who has access to an API is an integral part of development. For\nexample, as you test your API, you might want to automate redeploying updated\nCloud Endpoints configurations by using a service account that has the\npermission to do so. By default, only the project owner can manage access to an\nAPI. This page shows you how to grant and revoke access to your API by using the\nGoogle Cloud console or the Google Cloud CLI.\n\nEndpoints uses\n[Identity and Access Management](/iam/docs/overview)\nroles to grant and revoke access at the API level. You can grant and revoke\naccess to a user, service account, or to a\n[Google Group](https://support.google.com/groups/answer/2464926).\n\nGoogle Groups are a convenient way to grant or revoke access to a collection of\nusers. You can grant or revoke access for a whole group at once, instead of\ngranting or revoking access one at a time for individual users or service\naccounts. You can also easily add members to and remove members from a\nGoogle Group instead of granting or revoking the IAM role for\neach member.\n\nGranting access\n---------------\n\n### Google Cloud console\n\n1. In the Google Cloud console, go to the **Endpoints \\\u003e Services** page for your project.\n\n [Go to the Endpoints Services page](https://console.cloud.google.com/endpoints)\n2. If you have more than one API, click the name of the API.\n3. If the **Permissions** side panel isn't open, click **addPermissions**.\n4. In the **Add members** box, enter the email address of a user, service account, or Google Group.\n5. In the **Select a role** drop-down, click **Service Management** , and select one of the following roles:\n - **Service Consumer:** This role contains the permissions for a non-project member to view and enable the API in their own project. If you have created a [portal](/endpoints/docs/openapi/dev-portal-overview) for your API, this role lets your API users access the portal.\n - **Service Controller:** This role contains the permissions to make calls to the `check` and `\n report` methods in the [Service Infrastructure](/service-infrastructure/docs/checking-status) API during runtime.\n - **Service Config Editor:** This role contains the minimum permissions that Service Management requires to deploy an Endpoints configuration to an existing service.\n - **Service Management Administrator:** This role contains the permissions in the Service Config Editor, Service Consumer, and Service Controller roles, plus the permissions required to grant access to this API by using `gcloud` or the programmatic methods described in [Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\n\n See the [Service Management API access control](/service-infrastructure/docs/service-management/access-control#roles)\n topic for information about this role. Although the Google Cloud console allows you to select other roles,\n those roles aren't useful for managing your API.\n6. To add the member to the specified IAM role, click **Add**.\n7. Repeat adding members and selecting the role, as needed.\n8. The Service Management roles don't allow users to access the **Endpoints** \\\u003e **Services** page in the Google Cloud console. If you want users to be able access the **Endpoints** \\\u003e **Services** page, you must grant them the **Project Viewer** role or a higher role on the project. See [Granting, changing,\n and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\n### gcloud\n\n1. Open Cloud Shell, or if you have the Google Cloud CLI installed, open a terminal window.\n2. Enter the applicable `gcloud` command:\n - If you are granting access to a user, run the following: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding [SERVICE-NAME] \\\n --member='user:[EMAIL-ADDRESS]' \\\n --role='[ROLE]'\n ```\n\n For the role, specify one of the following IAM roles:\n - `roles/servicemanagement.configEditor`: This role contains the minimum permissions that Service Management requires to deploy an Endpoints configuration to an existing service.\n - `roles/servicemanagement.admin`: This role contains the permissions in `roles/servicemanagement.configEditor`, `roles/servicemanagement.serviceConsumer`, and `roles/servicemanagement.serviceController`, plus the permissions required to grant access to this API by using `gcloud` or the programmatic methods described in [Granting,\n changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\n \u003cbr /\u003e\n\n For example: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding example-service-name \\\n --member='user:example-user@gmail.com' \\\n --role='roles/servicemanagement.admin'\n ```\n\n \u003cbr /\u003e\n\n - If you are granting access to a service account, run the following: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding [SERVICE-NAME] \\\n --member='serviceAccount:[EMAIL-ADDRESS]' \\\n --role='[ROLE]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding example-service-name \\\n --member='serviceAccount:example-service-account@example-project.iam.gserviceaccount.com' \\\n --role='roles/servicemanagement.configEditor'\n ```\n\n \u003cbr /\u003e\n\n - If you are granting access to a Google Group, run the following: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding [SERVICE-NAME] \\\n --member='group:[GROUP-NAME]@googlegroups.com' \\\n --role='[ROLE]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding example-service-name \\\n --member='group:example-group@googlegroups.com' \\\n --role='roles/servicemanagement.configEditor'\n ```\n\n \u003cbr /\u003e\n\n3. The Service Management roles don't allow users to access the **Endpoints** \\\u003e **Services** page in the Google Cloud console. If you want users to be able access the **Endpoints** \\\u003e **Services** page, you must grant them the **Project Viewer** role or a higher role on the project. See [Granting, changing,\n and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\nRevoking access\n---------------\n\nTo revoke access to your API, remove the IAM role from the member\nwho previously had the role. \n\n### Google Cloud console\n\n1. In the Google Cloud console, go to the **Endpoints** \\\u003e **Services** page for your project.\n\n [Go to the Endpoints Services page](https://console.cloud.google.com/endpoints)\n2. If you have more than one API, click the name of the API.\n3. If the **Permissions** side panel isn't open, click **addPermissions**.\n4. Locate the member for whom you want to revoke access. You can either click the applicable **Role** card to see a list of members, or you can enter a name or role in the **Search members** box.\n5. Click **Delete** delete.\n6. If you also want to revoke a user's access to your Google Cloud project, see [Granting,\n changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\n### gcloud\n\n1. Open Cloud Shell, or, if you have the gcloud CLI installed, open a terminal window.\n2. Enter the applicable `gcloud` command:\n - If you are revoking access for a user, run the following: \n\n ```text\n gcloud endpoints services remove-iam-policy-binding [SERVICE-NAME] \\\n --member='user:[EMAIL-ADDRESS]' \\\n --role='[ROLE-NAME]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding example-service-name \\\n --member='user:example-user@gmail.com' \\\n --role='roles/editor'\n ```\n - If you are revoking access for a service account, run the following: \n\n ```text\n gcloud endpoints services remove-iam-policy-binding [SERVICE-NAME] \\\n --member='serviceAccount:[EMAIL-ADDRESS]' \\\n --role='[ROLE-NAME]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding example-service-name \\\n --member='serviceAccount:example-service-account@example-project.iam.gserviceaccount.com' \\\n --role='roles/servicemanagement.configEditor'\n ```\n - If you are revoking access for a Google Group, run the following: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding [SERVICE-NAME] \\\n --member='group:[GROUP-NAME]@googlegroups.com' \\\n --role='[ROLE-NAME]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding example-service-name \\\n --member='group:example-group@googlegroups.com' \\\n --role='roles/viewer'\n ```\n3. If you also want to revoke a user's access to your Google Cloud project, see [Granting,\n changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\nWhat's next\n-----------\n\nLearn about:\n\n- [Creating a service account](/iam/docs/creating-managing-service-accounts#creating_a_service_account)\n- [`gcloud` commands](/sdk/gcloud/reference) referenced on this page."]]
