Google Network Security API
Browse all Google APIs✓ Official Vendor SpecSecurityComplianceoauth247 EndpointsREST
For Agents
Configure and manage Google Cloud network security policies — address groups, TLS policies, authorization policies, and security profile groups — across regional locations.
Use for: I need to create an address group of allowed IP CIDRs, Add a new IP range to an existing network security address group, List all server TLS policies in a given region, Create an authorization policy that denies a specific service account
Not supported: Does not handle VPC firewall rule enforcement, identity-level access control, or DDoS mitigation — use for declaring network security policy resources only.
The Network Security API configures and manages Google Cloud network security policies — address groups, authorization policies, server and client TLS policies, gateway security policies, and security profile groups. It provides the control plane for shaping which traffic is allowed across VPC networks, load balancers, and Google Cloud workloads. Use it to define IP allow lists, enforce mTLS, attach URL filtering rules, and bind security profiles to gateways. The spec exposes 47 endpoints across regional locations and long-running operations.
Install Jentic One Beta
Connect the Network Security API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Network Security API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Network Security API.
Create address groups and add or remove IP CIDRs to drive allow/deny rules across VPCs
Author authorization policies that gate east-west and north-south traffic on managed gateways
Roll out server and client TLS policies to enforce mTLS between Google Cloud services
Define gateway security policies and attach URL filtering rules to mediate egress traffic
Bind security profile groups to firewall and gateway resources for layered threat inspection
Track regional rollout via long-running operations and cancel in-flight changes when needed
Use Cases
Patterns agents use Network Security API for, with concrete tasks.
★ Centralised IP allow lists across regions
Maintain reusable address groups that hold allowed or blocked IP CIDRs, then reference them from firewall and authorization policies across multiple regions. The Network Security API lets you add, clone, and remove items from a group atomically so policy changes propagate through one source of truth instead of dozens of inline rules. Suitable for organisations standardising egress controls or enforcing partner allow lists across hundreds of VPCs.
Create an address group named partner-allowlist in us-central1, add CIDRs 203.0.113.0/24 and 198.51.100.0/24, and confirm the operation finished successfully.
Mutual TLS enforcement between services
Author server and client TLS policies that enforce mTLS for traffic between Google Cloud workloads exposed via load balancers and service mesh endpoints. The API stores certificate authorities, validation rules, and SAN lists as policy resources you attach to backend services. Useful for zero-trust deployments that need cryptographic identity instead of network-level trust.
Create a server TLS policy that requires client certificates issued by a specific CertificateAuthorityService CA and attach it to the backend service my-grpc-service.
Gateway URL filtering and threat inspection
Define gateway security policies with ordered URL filtering rules and bind security profile groups for deep inspection. The API targets traffic flowing through Secure Web Proxy and other Google Cloud network gateways so security teams can block categories, log decisions, and route traffic through TLS interception. Reduces the friction of editing rule sets directly inside the gateway console.
Create a gateway security policy gw-egress-policy in europe-west1, add a URL filtering rule that denies category gambling, and bind security profile group threats-default.
Agent-driven network security automation via Jentic
Through Jentic, AI agents can author and update network security resources without holding raw OAuth tokens. The agent issues an intent like configure mTLS, Jentic returns the matching Network Security API operation with its input schema, and execution happens with credentials brokered via the Jentic vault. This lets ops chatbots and remediation agents adjust policies in response to alerts in seconds.
Use Jentic to find the operation that adds items to an address group, load its schema, and execute it to add 10.0.0.0/8 to corp-internal-ranges.
Key Endpoints
47 endpoints — the network security api configures and manages google cloud network security policies — address groups, authorization policies, server and client tls policies, gateway security policies, and security profile groups.
METHOD
PATH
DESCRIPTION
POST
/v1/{+addressGroup}:addItems
Add IP CIDRs to an address group
POST
/v1/{+addressGroup}:removeItems
Remove IP CIDRs from an address group
POST
/v1/{+parent}/addressGroups
Create a new address group
GET
/v1/{+addressGroup}:listReferences
List policies that reference an address group
POST
/v1/{+name}:cancel
Cancel a long-running operation
GET
/v1/{+name}/operations
List operations for a parent resource
POST
/v1/{+addressGroup}:addItems
Add IP CIDRs to an address group
POST
/v1/{+addressGroup}:removeItems
Remove IP CIDRs from an address group
POST
/v1/{+parent}/addressGroups
Create a new address group
GET
/v1/{+addressGroup}:listReferences
List policies that reference an address group
POST
/v1/{+name}:cancel
Cancel a long-running operation
GET
/v1/{+name}/operations
List operations for a parent resource
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Google OAuth 2.0 access tokens are minted from a service-account refresh credential stored in the Jentic vault (MAXsystem). Agents receive scoped, short-lived tokens — the underlying private key never enters the agent context.
Intent-based discovery
Agents search Jentic with intents like configure mtls policy or add ip to allow list and Jentic returns the matching Network Security API operation, its input schema, and its required scopes — no doc browsing required.
Time to first call
Direct integration with the Network Security API: 1-2 days to wire OAuth, retries, and long-running operation polling. Through Jentic: under 30 minutes — search, load, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Network Security API through Jentic.
What authentication does the Network Security API use?
The API uses Google OAuth 2.0 with the cloud-platform scope. When called through Jentic, the OAuth token is brokered from the encrypted Jentic vault so agents never see the raw credential.
Can I manage IP allow lists with the Network Security API?
Yes. The addItems, removeItems, and cloneItems operations on /v1/{+addressGroup} let you mutate address group membership, and the resulting groups can be referenced from firewall rules and authorization policies.
What are the rate limits for the Network Security API?
Google Cloud applies per-project quotas for control-plane writes — typically a few hundred mutating operations per minute. Exact ceilings appear in the Cloud Console quotas page; treat large rollouts as long-running by polling the operations endpoint.
How do I create a server TLS policy through Jentic?
Search Jentic for create server tls policy, load the schema for the POST on /v1/{+parent}/serverTlsPolicies, and execute it with the parent location and policy body. The Jentic SDK runs the call asynchronously and returns the long-running operation handle.
Does this API handle data plane packet filtering?
No — the API is a control plane that defines policy resources. Packet enforcement happens inside the VPC firewall, load balancers, and Secure Web Proxy data planes that consume these policies.
How do I track a long-running rollout?
Every mutating call returns an operation. Poll /v1/{+name}/operations and inspect the done field; cancel in-flight changes by POSTing to /v1/{+name}:cancel.
GET STARTED