Stay organized with collections
Save and categorize content based on your preferences.
This page
applies to Apigee and Apigee hybrid.
Predefined roles give granular access to specific Google Cloud resources. These roles are created and maintained by Google. Google automatically updates their permissions as necessary, such as when Google Cloud adds new features or services.
The following table lists all the predefined IAM roles for API hub:
IAM role
Granted permissions
Role
Permissions
Cloud API Hub Admin
Beta
(roles/apihub.admin)
Full access to all API hub resources.
apihub.*
apihub.apiHubInstances.create
apihub.apiHubInstances.delete
apihub.apiHubInstances.get
apihub.apiHubInstances.list
apihub.apiOperations.create
apihub.apiOperations.delete
apihub.apiOperations.get
apihub.apiOperations.list
apihub.apiOperations.update
apihub.apis.create
apihub.apis.createTagBinding
apihub.apis.delete
apihub.apis.deleteTagBinding
apihub.apis.get
apihub.apis.list
apihub.apis.listEffectiveTags
apihub.apis.listTagBindings
apihub.apis.update
apihub.attributes.create
apihub.attributes.delete
apihub.attributes.get
apihub.attributes.list
apihub.attributes.update
apihub.curations.create
apihub.curations.delete
apihub.curations.get
apihub.curations.list
apihub.curations.update
apihub.definitions.get
apihub.definitions.list
apihub.definitions.update
apihub.dependencies.create
apihub.dependencies.delete
apihub.dependencies.get
apihub.dependencies.list
apihub.dependencies.update
apihub.deployments.create
apihub.deployments.createTagBinding
apihub.deployments.delete
apihub.deployments.deleteTagBinding
apihub.deployments.get
apihub.deployments.list
apihub.deployments.listEffectiveTags
apihub.deployments.listTagBindings
apihub.deployments.update
apihub.discoveredApiObservations.get
apihub.discoveredApiObservations.list
apihub.discoveredApiOperations.get
apihub.discoveredApiOperations.list
apihub.externalApis.create
apihub.externalApis.delete
apihub.externalApis.get
apihub.externalApis.list
apihub.externalApis.update
apihub.hostProjectRegistrations.create
apihub.hostProjectRegistrations.delete
apihub.hostProjectRegistrations.get
apihub.hostProjectRegistrations.list
apihub.hostProjectRegistrations.register
apihub.llmEnablements.deregister
apihub.llmEnablements.get
apihub.llmEnablements.list
apihub.llmEnablements.register
apihub.locations.collectApiData
apihub.locations.searchResources
apihub.locations2.searchResources
apihub.operations.cancel
apihub.operations.delete
apihub.operations.get
apihub.operations.list
apihub.plugininstances.applyConfig
apihub.plugininstances.create
apihub.plugininstances.delete
apihub.plugininstances.disable
apihub.plugininstances.enable
apihub.plugininstances.execute
apihub.plugininstances.get
apihub.plugininstances.list
apihub.plugininstances.update
apihub.plugins.create
apihub.plugins.delete
apihub.plugins.disable
apihub.plugins.enable
apihub.plugins.get
apihub.plugins.list
apihub.runTimeProjectAttachments.attach
apihub.runTimeProjectAttachments.create
apihub.runTimeProjectAttachments.delete
apihub.runTimeProjectAttachments.get
apihub.runTimeProjectAttachments.list
apihub.runTimeProjectAttachments.lookup
apihub.specs.create
apihub.specs.delete
apihub.specs.get
apihub.specs.lint
apihub.specs.list
apihub.specs.update
apihub.styleGuides.get
apihub.styleGuides.update
apihub.versions.create
apihub.versions.delete
apihub.versions.get
apihub.versions.list
apihub.versions.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Attributes Admin
Beta
(roles/apihub.attributeAdmin)
Full access to all Cloud API hub attribute's resources.
apihub.attributes.*
apihub.attributes.create
apihub.attributes.delete
apihub.attributes.get
apihub.attributes.list
apihub.attributes.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API Hub Editor
Beta
(roles/apihub.editor)
Edit access to most of Cloud API Hub resources.
apihub.apiHubInstances.get
apihub.apiHubInstances.list
apihub.apiOperations.*
apihub.apiOperations.create
apihub.apiOperations.delete
apihub.apiOperations.get
apihub.apiOperations.list
apihub.apiOperations.update
apihub.apis.*
apihub.apis.create
apihub.apis.createTagBinding
apihub.apis.delete
apihub.apis.deleteTagBinding
apihub.apis.get
apihub.apis.list
apihub.apis.listEffectiveTags
apihub.apis.listTagBindings
apihub.apis.update
apihub.attributes.get
apihub.attributes.list
apihub.curations.get
apihub.curations.list
apihub.definitions.*
apihub.definitions.get
apihub.definitions.list
apihub.definitions.update
apihub.dependencies.*
apihub.dependencies.create
apihub.dependencies.delete
apihub.dependencies.get
apihub.dependencies.list
apihub.dependencies.update
apihub.deployments.*
apihub.deployments.create
apihub.deployments.createTagBinding
apihub.deployments.delete
apihub.deployments.deleteTagBinding
apihub.deployments.get
apihub.deployments.list
apihub.deployments.listEffectiveTags
apihub.deployments.listTagBindings
apihub.deployments.update
apihub.discoveredApiObservations.*
apihub.discoveredApiObservations.get
apihub.discoveredApiObservations.list
apihub.discoveredApiOperations.*
apihub.discoveredApiOperations.get
apihub.discoveredApiOperations.list
apihub.externalApis.*
apihub.externalApis.create
apihub.externalApis.delete
apihub.externalApis.get
apihub.externalApis.list
apihub.externalApis.update
apihub.hostProjectRegistrations.get
apihub.hostProjectRegistrations.list
apihub.llmEnablements.*
apihub.llmEnablements.deregister
apihub.llmEnablements.get
apihub.llmEnablements.list
apihub.llmEnablements.register
apihub.locations.*
apihub.locations.collectApiData
apihub.locations.searchResources
apihub.operations.get
apihub.operations.list
apihub.plugininstances.get
apihub.plugininstances.list
apihub.plugins.get
apihub.plugins.list
apihub.runTimeProjectAttachments.get
apihub.runTimeProjectAttachments.list
apihub.specs.*
apihub.specs.create
apihub.specs.delete
apihub.specs.get
apihub.specs.lint
apihub.specs.list
apihub.specs.update
apihub.styleGuides.get
apihub.versions.*
apihub.versions.create
apihub.versions.delete
apihub.versions.get
apihub.versions.list
apihub.versions.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Plugins Admin
Beta
(roles/apihub.pluginAdmin)
Full access to all Cloud API hub plugin's resources.
apihub.curations.*
apihub.curations.create
apihub.curations.delete
apihub.curations.get
apihub.curations.list
apihub.curations.update
apihub.locations.collectApiData
apihub.operations.*
apihub.operations.cancel
apihub.operations.delete
apihub.operations.get
apihub.operations.list
apihub.plugininstances.*
apihub.plugininstances.applyConfig
apihub.plugininstances.create
apihub.plugininstances.delete
apihub.plugininstances.disable
apihub.plugininstances.enable
apihub.plugininstances.execute
apihub.plugininstances.get
apihub.plugininstances.list
apihub.plugininstances.update
apihub.plugins.*
apihub.plugins.create
apihub.plugins.delete
apihub.plugins.disable
apihub.plugins.enable
apihub.plugins.get
apihub.plugins.list
apihub.specs.lint
apihub.styleGuides.*
apihub.styleGuides.get
apihub.styleGuides.update
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Provisioning Admin
Beta
(roles/apihub.provisioningAdmin)
Full access to Cloud API hub provisioning related resources.
apihub.apiHubInstances.*
apihub.apiHubInstances.create
apihub.apiHubInstances.delete
apihub.apiHubInstances.get
apihub.apiHubInstances.list
apihub.hostProjectRegistrations.*
apihub.hostProjectRegistrations.create
apihub.hostProjectRegistrations.delete
apihub.hostProjectRegistrations.get
apihub.hostProjectRegistrations.list
apihub.hostProjectRegistrations.register
apihub.operations.*
apihub.operations.cancel
apihub.operations.delete
apihub.operations.get
apihub.operations.list
apihub.runTimeProjectAttachments.*
apihub.runTimeProjectAttachments.attach
apihub.runTimeProjectAttachments.create
apihub.runTimeProjectAttachments.delete
apihub.runTimeProjectAttachments.get
apihub.runTimeProjectAttachments.list
apihub.runTimeProjectAttachments.lookup
resourcemanager.projects.get
resourcemanager.projects.list
Cloud API hub Runtime Project Attachment Editor
Beta
(roles/apihub.runTimeProjectAttachmentsEditor)
Access to add/delete project as a runtime project attachment to API hub host project.
apihub.runTimeProjectAttachments.attach
API-Hub Runtime Project Service Agent
(roles/apihub.runtimeProjectServiceAgent)
Gives API-Hub Service Account access to runtime project resources.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-04 UTC."],[[["This document details the predefined IAM roles for various Google Cloud services, including API Hub, App Hub, Appliance, Assured OSS, Audit Manager, Autoscaling, and Batch, among others."],["Each IAM role grants specific permissions to interact with Google Cloud resources, providing varying levels of access, such as admin, editor, viewer, and user."],["The roles listed encompass a wide array of functionalities, from managing API resources and application hubs to troubleshooting appliances and managing audit configurations."],["Permissions are granular and are automatically updated by Google, allowing access to individual resources or whole management sections, such as viewing configurations or modifying settings."],["There are roles pertaining to specific functions in some of the categories, including but not limited to; creating, viewing, updating, deploying, and approving resources, allowing for fine tuning of permissions."]]],[]]
