Google Network Connectivity API
Browse all Google APIs✓ Official Vendor SpecCloud InfrastructureNetworkingoauth235 EndpointsREST
For Agents
Provision and manage Google Cloud Network Connectivity Center hubs, spokes, and routes. Use to wire VPCs and on-premises networks into a single hub topology.
Use for: Create a new Network Connectivity Center hub, Attach a VPC as a spoke to an existing hub, List all spokes connected to a hub, Reserve an internal IP range to prevent overlap
Not supported: Does not provision VPCs, run firewall rules, or perform reachability testing — use for Network Connectivity Center hub, spoke, and internal-range governance only.
The Network Connectivity API manages Google Cloud's Network Connectivity Center — a hub-and-spoke service that interconnects on-premises networks, VPCs, and hybrid environments. It exposes hubs, spokes, route tables, internal ranges, and policy-based routes so platform teams can build, inspect, and govern transitive connectivity across global Google Cloud infrastructure. Pair it with Compute Engine networking and Cloud DNS for a full hybrid networking control plane.
Install Jentic One Beta
Connect the Network Connectivity API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Network Connectivity API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Network Connectivity API.
Create a Network Connectivity Center hub and attach VPC or hybrid spokes
Inspect and modify route tables and routes within a hub
Reserve internal IP ranges to avoid VPC overlap
Define policy-based routes that steer traffic by source or protocol
Approve or reject pending spoke updates from peer accounts
Track long-running operations for hub and spoke changes
Use Cases
Patterns agents use Network Connectivity API for, with concrete tasks.
★ Hub-and-Spoke Network Build-Out
Platform teams wire dozens of VPCs and on-premises networks into one transitive topology using a Network Connectivity Center hub. The API supports POSTing hubs and then attaching spokes for VPC, VPN tunnels, interconnect attachments, and router appliances, replacing the manual mesh of VPC peerings with a single hub managed centrally.
POST /v1/{parent}/hubs to create the hub, then POST /v1/{parent}/spokes for each VPC attachment with linkedVpcNetwork.uri set.
Cross-Project Spoke Approval
Spokes can come from other projects and may require explicit approval before joining the hub. The acceptSpoke and rejectSpoke endpoints let a platform team gate which peer projects join, with full audit logging on each decision. This enforces a clear governance boundary on shared infrastructure.
POST /v1/{name}:acceptSpoke or :rejectSpoke on each pending spoke, providing the requestId for idempotency.
Internal Range Governance
VPCs that share a hub must avoid CIDR collisions. The internalRanges resource lets a platform team reserve named ranges, allocate them to projects, and detect overlaps before a new VPC is created. Combined with policy-based routes, this gives a deterministic IP plan across the estate.
POST /v1/{parent}/internalRanges with peering and a target CIDR, then GET to confirm allocation and surface overlaps to the requester.
AI Agent Network Operator
An AI agent reachable through Jentic operates the connectivity hub: it lists pending spokes, approves those from allow-listed projects, reserves internal ranges from a planned pool, and reports on long-running operations. Jentic isolates the OAuth credentials and exposes the right Network Connectivity operation per intent.
Search Jentic for 'attach a VPC spoke to a Network Connectivity hub', load projects.locations.spokes.create, and execute with the linkedVpcNetwork.uri.
Key Endpoints
35 endpoints — the network connectivity api manages google cloud's network connectivity center — a hub-and-spoke service that interconnects on-premises networks, vpcs, and hybrid environments.
METHOD
PATH
DESCRIPTION
GET
/v1/{name}
Get a hub, spoke, or other resource by name
DELETE
/v1/{name}
Delete a resource
PATCH
/v1/{name}
Update a resource
POST
/v1/{name}:acceptSpoke
Approve a pending spoke
POST
/v1/{name}:cancel
Cancel a long-running operation
GET
/v1/{name}/locations
List locations for the API
GET
/v1/{name}
Get a hub, spoke, or other resource by name
DELETE
/v1/{name}
Delete a resource
PATCH
/v1/{name}
Update a resource
POST
/v1/{name}:acceptSpoke
Approve a pending spoke
POST
/v1/{name}:cancel
Cancel a long-running operation
GET
/v1/{name}/locations
List locations for the API
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
OAuth 2.0 refresh tokens are stored encrypted in the Jentic vault. The agent receives scoped, short-lived access tokens — Google Cloud service account keys never enter the agent context.
Intent-based discovery
Agents search Jentic by intent (e.g. 'attach a VPC spoke to a hub') and Jentic returns the matching Network Connectivity operation with its input schema.
Time to first call
Direct integration: 2-5 days for OAuth, IAM role design, and long-running operation polling. Through Jentic: under an hour — search, load, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Network Connectivity API through Jentic.
What authentication does the Network Connectivity API use?
OAuth 2.0 with the https://www.googleapis.com/auth/cloud-platform scope (the spec declares Oauth2 securitySchemes). The caller's principal needs networkconnectivity IAM roles on the project. Through Jentic the OAuth refresh token is held in MAXsystem and the agent only receives scoped access tokens.
Can I attach an on-premises network as a spoke?
Yes. POST /v1/{parent}/spokes with linkedInterconnectAttachments or linkedVpnTunnels referencing the hybrid resources, and the on-premises traffic flows through the hub to other spokes that allow it.
What are the rate limits for the Network Connectivity API?
Like most Google Cloud APIs the per-project quota is documented in Cloud Console under IAM and Admin > Quotas. Mutating calls return long-running operations; poll the operations resource and back off on 429 with exponential backoff.
How do I attach a VPC spoke through Jentic?
Search Jentic for 'attach a VPC spoke to a Network Connectivity hub', load projects.locations.spokes.create, and execute with parent set to the hub's location and linkedVpcNetwork.uri set to the VPC self link. Jentic refreshes the OAuth token in the background.
Does this API replace VPC peering?
Network Connectivity Center hubs provide transitive connectivity across many spokes, removing the N-squared peering mesh. VPC peering is still available for direct two-VPC scenarios and is configured via the Compute Engine API, not this one.
GET STARTED