Google Firebase Rules API
Browse all Google APIs✓ Official Vendor SpecSecurityAuthorizationoauth29 EndpointsREST
For Agents
Create rulesets, publish releases, and test Firebase security rules against synthetic requests so an agent can deploy and validate Firestore, Realtime Database, and Storage authorisation from CI.
Use for: Publish a new Firestore security ruleset, Promote a ruleset to the cloud.firestore release, List all releases for a Firebase project, Test Firestore security rules against a synthetic request
Not supported: Does not authenticate end users, store data, or replace App Check attestation — use for managing and testing Firebase security rulesets and releases only.
The Firebase Rules API creates and manages the security rules that determine when a Firebase Rules-enabled service such as Cloud Firestore, Realtime Database, or Cloud Storage should permit a request. It exposes operations to manage rulesets (immutable rule documents), releases (named pointers to rulesets), fetch the executable form of a release, and run rule tests against synthetic requests. Use it to deploy and validate security rules from CI rather than the Firebase console.
Install Jentic One Beta
Connect the Firebase Rules API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Firebase Rules API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Firebase Rules API.
Publish a new ruleset for Firestore, Realtime Database, or Cloud Storage
Promote a ruleset by creating or updating a named release such as cloud.firestore
Retrieve the compiled executable representation of a Firebase Rules release
Run rule unit tests against a ruleset with synthetic request contexts
List historical rulesets and releases for an audit trail of authorisation policy changes
Use Cases
Patterns agents use Firebase Rules API for, with concrete tasks.
★ CI-Driven Security Rule Deployments
Wire a CI pipeline to publish a new Firebase Rules ruleset on every merge to main and update the cloud.firestore release to point at it via PATCH /v1/{+name}. The Firebase Rules API replaces the firebase deploy --only firestore:rules CLI flow with a deterministic REST chain, ideal when rules deploys must be gated by additional approvals before reaching production.
Call POST /v1/{+name}/rulesets to create a ruleset from the rules.firestore source, then PATCH /v1/{+name} on projects/PROJECT/releases/cloud.firestore to point at the new ruleset name.
Automated Rule Unit Testing
Run rule tests in CI by sending synthetic request contexts through POST /v1/{+name}:test against a candidate ruleset before promoting it. The endpoint reports whether each test case is allowed or denied, so a regression in security policy fails the build instead of reaching production. Test integration takes a few hours per project.
Call POST /v1/{+name}:test on the new ruleset name with a testSuite that includes a denied unauthenticated read and an allowed owner write, and fail the CI step if any expected outcome does not match.
Authorisation Policy Audit Trail
Use GET /v1/{+name}/releases and GET /v1/{+name}/rulesets to build an audit trail of every Firebase Rules version deployed to a project, including who promoted which ruleset to which release. This supports compliance reviews and post-incident investigations where you need to know which security policy was active at a given moment.
Call GET /v1/{+name}/releases for projects/PROJECT and pair each release.updateTime with the rulesetName it pointed at to produce a chronological audit log.
Agent-Driven Rule Reviews via Jentic
An AI agent connected through Jentic can review pending changes to Firebase Rules, run synthetic tests against the candidate ruleset, and recommend whether to promote it to a release. Jentic exposes the 9 Firebase Rules endpoints, the agent loads test, ruleset, and release operations, and OAuth 2.0 credentials remain inside the Jentic vault.
Through Jentic, search for test firebase security rules, load the projects.test operation, and execute it with a testSuite that exercises the change set against the candidate ruleset name.
Key Endpoints
9 endpoints — the firebase rules api creates and manages the security rules that determine when a firebase rules-enabled service such as cloud firestore, realtime database, or cloud storage should permit a request.
METHOD
PATH
DESCRIPTION
POST
/v1/{+name}/rulesets
Create a new Firebase Rules ruleset
GET
/v1/{+name}/rulesets
List rulesets under a project
POST
/v1/{+name}/releases
Create a new Firebase Rules release
GET
/v1/{+name}/releases
List releases under a project
PATCH
/v1/{+name}
Update a release to point at a different ruleset
POST
/v1/{+name}:test
Run rule tests against a ruleset
GET
/v1/{+name}:getExecutable
Retrieve the executable representation of a release
POST
/v1/{+name}/rulesets
Create a new Firebase Rules ruleset
GET
/v1/{+name}/rulesets
List rulesets under a project
POST
/v1/{+name}/releases
Create a new Firebase Rules release
GET
/v1/{+name}/releases
List releases under a project
PATCH
/v1/{+name}
Update a release to point at a different ruleset
POST
/v1/{+name}:test
Run rule tests against a ruleset
GET
/v1/{+name}:getExecutable
Retrieve the executable representation of a release
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Google OAuth 2.0 service-account credentials are stored in the Jentic vault. Agents receive a scoped access token per call so the underlying private key never enters the agent's prompt or tool-call payloads.
Intent-based discovery
Agents search Jentic with intents like deploy firebase security rules or test firebase security rules and Jentic returns the matching rulesets.create, releases.patch, and projects.test operations along with their input schemas.
Time to first call
Direct integration with the Firebase Rules API: 2-3 days for OAuth, ruleset versioning, release pointer management, and rule test plumbing. Through Jentic: under 1 hour.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Firebase Rules API through Jentic.
What authentication does the Firebase Rules API use?
The API uses Google OAuth 2.0 with the firebase.readonly, firebase, or cloud-platform scope depending on whether the call is read-only or mutating. Through Jentic the OAuth credentials are stored in the encrypted vault and a scoped access token is supplied per request.
Can I deploy Firestore security rules with the Firebase Rules API?
Yes. POST /v1/{+name}/rulesets creates a new ruleset from your rules source, then PATCH /v1/{+name} on the cloud.firestore release pointer flips production traffic to it. This is the same flow that firebase deploy --only firestore:rules uses underneath.
What are the rate limits for the Firebase Rules API?
Google enforces standard googleapis.com project-level quotas for the Firebase Rules API. Ruleset creation is rate-limited because each ruleset is immutable and persisted; pipelines should avoid creating one ruleset per file change and instead bundle changes per release.
How do I run a Firebase Rules test through Jentic?
Run pip install jentic, search for test firebase security rules, load the projects.test operation, and execute it with the candidate rulesetName and a testSuite of synthetic request expectations. Sign up at https://app.jentic.com/sign-up.
Does the Firebase Rules API support Cloud Storage rules and Realtime Database rules?
Yes. The same ruleset and release machinery covers Cloud Firestore, Cloud Storage, and Realtime Database; the release name (such as cloud.firestore or firebase.storage) determines which Firebase service the ruleset is bound to.
Is the Firebase Rules API free?
Firebase Rules is included with Firebase at no extra charge. Rule evaluation cost is incurred only when a Firebase service evaluates the rules during a request, and that cost is billed under the underlying service such as Firestore or Cloud Storage.
GET STARTED