Required APIs ↗
Why Enabling APIs is Required
In Google Cloud Platform (GCP), services operate under a modular, opt-in architecture. By default, a newly created GCP project keeps the vast majority of Google Cloud APIs disabled. Enabling specific APIs during onboarding grants your project explicit permission to interact with the underlying Google Cloud services. If a required API is disabled, Cortex XSIAM cannot access that service, preventing us from discovering or scanning those assets.
The list below covers all APIs Cortex XSIAM needs to run full asset discovery across every supported GCP service. This is not tied to which security capabilities you have configured. If you have not enabled DSPM, for instance, Cortex XSIAM still discovers your database assets, but it does not scan them. The APIs control what we can see, not what we act on.
Your deployment may only use a subset of these services. Enabling the full list ensures complete coverage and allows Cortex XSIAM to maintain a real-time, up-to-date asset inventory across all your services, even as your usage expands.
Ensure you have enabled the following APIs in the GCP project you are onboarding:
| accessapproval.googleapis.com | Access Approval — Requires explicit organization consent before Google administrators can access stored data. |
|---|---|
| accesscontextmanager.googleapis.com | Access Context Manager — Defines fine-grained, attribute-based access control rules for resources. |
| admin.googleapis.com | Workspace Admin API — Automates administrative actions across Google Workspace users, domains, and groups. |
| aiplatform.googleapis.com | Vertex AI Platform — Trains, deploys, and manages machine learning models and generative AI workflows. |
| alloydb.googleapis.com | AlloyDB for PostgreSQL — Fully managed PostgreSQL-compatible database built for high-end enterprise analytical and transactional workloads. |
| analyticshub.googleapis.com | Analytics Hub — Data exchange platform allowing organizations to share BigQuery datasets securely. |
| apigateway.googleapis.com | API Gateway — Securely manages and routes traffic to backend APIs, Cloud Functions, or Cloud Run endpoints. |
| apigee.googleapis.com | Apigee API Management — Designs, secures, analyzes, and scales enterprise API gateways. |
| apihub.googleapis.com | API Hub — Centralized internal inventory and catalog for organizing organizational API assets. |
| apikeys.googleapis.com | API Keys API — Creates, restricts, and manages API authentication key strings. |
| appengine.googleapis.com | App Engine — Web Platform-as-a-Service (PaaS) for building and hosting web applications at scale. |
| artifactregistry.googleapis.com | Artifact Registry — Stores and manages container images, language packages (Maven, npm, PyPI), and OS packages. |
| backupdr.googleapis.com | Backup and DR Service — Centralizes backup, recovery, and disaster recovery policies for enterprise workloads. |
| baremetalsolution.googleapis.com | Bare Metal Solution — Provisions dedicated hardware directly inside Google data centers for specialized workloads. |
| batch.googleapis.com | Cloud Batch — Schedules, manages, and executes large-scale batch processing, HPC, and AI workloads. |
| biglake.googleapis.com | BigLake — Storage engine unifying BigQuery and open-source formats across data lakes. |
| bigquery.googleapis.com | BigQuery — Serverless, highly scalable enterprise data warehouse for running SQL analytics. |
| bigquerydatapolicy.googleapis.com | BigQuery Data Policy — Sets security controls for row-level and column-level data masking in BigQuery. |
| bigquerydatatransfer.googleapis.com | BigQuery Data Transfer Service — Automates data ingestion into BigQuery from external databases and SaaS tools. |
| bigqueryreservation.googleapis.com | BigQuery Reservation API — Allocates compute capacity (slots) and flat-rate pricing models for BigQuery queries. |
| bigtableadmin.googleapis.com | Cloud Bigtable Admin — Manages administrative lifecycle tasks for scalable NoSQL wide-column database clusters. |
| binaryauthorization.googleapis.com | Binary Authorization — Enforces software supply chain safety by ensuring only trusted container images deploy. |
| certificatemanager.googleapis.com | Certificate Manager — Provisions and manages public and private SSL/TLS certificates for Google Cloud load balancers. |
| ces.googleapis.com | Customer Environment Services — Internal APIs supporting Google Cloud Support operations and environment health monitoring. |
| cloudasset.googleapis.com | Cloud Asset Inventory — Searches, exports, and monitors Google Cloud resource and IAM policy metadata. |
| cloudbilling.googleapis.com | Cloud Billing API — Programmatically monitors costs, pulls invoice data, and manages billing account setups. |
| cloudbuild.googleapis.com | Cloud Build — Continuous integration and continuous delivery (CI/CD) serverless platform. |
| clouddeploy.googleapis.com | Cloud Deploy — Managed continuous delivery service automating releases to Cloud Run and Kubernetes (GKE). |
| cloudfunctions.googleapis.com | Cloud Functions — Event-driven Function-as-a-Service (FaaS) running serverless code snippets. |
| cloudidentity.googleapis.com | Cloud Identity — Manages identities, users, mobile devices, and security groups across Google services. |
| cloudkms.googleapis.com | Cloud Key Management Service — Manages encryption keys (symmetric/asymmetric) and cryptographic hardware (HSM). |
| cloudresourcemanager.googleapis.com | Cloud Resource Manager — Manages organizations, folders, and project structures for GCP asset hierarchy. |
| cloudscheduler.googleapis.com | Cloud Scheduler — Fully managed enterprise cron job scheduler for triggering recurring operations. |
| cloudsupport.googleapis.com | Cloud Support API — Creates and manages technical support cases programmatically with Google Cloud Support. |
| cloudtasks.googleapis.com | Cloud Tasks — Asynchronous execution service for distributing task queues across microservices. |
| composer.googleapis.com | Cloud Composer — Managed workflow orchestration built on Apache Airflow. |
| compute.googleapis.com | Compute Engine — Creates and manages Virtual Machine (VM) instances, disks, and network settings. |
| connectors.googleapis.com | Integration Connectors — Connects Google Cloud integration services to enterprise applications and SaaS platforms. |
| contactcenterinsights.googleapis.com | Contact Center AI Insights — Applies natural language processing to customer service call logs and transcripts. |
| container.googleapis.com | Google Kubernetes Engine (GKE) — Managed Kubernetes service for deploying, scaling, and running container workloads. |
| containeranalysis.googleapis.com | Container Analysis — Scans container image vulnerabilities and stores supply chain security metadata. |
| dataflow.googleapis.com | Dataflow — Stream and batch data processing service running Apache Beam pipelines. |
| dataform.googleapis.com | Dataform — Transforms, tests, and manages SQL data models directly within BigQuery data warehouses. |
| datafusion.googleapis.com | Cloud Data Fusion — Visual, drag-and-drop ETL data integration service built on open-source CDAP. |
| datamigration.googleapis.com | Database Migration Service — Automates serverless migrations to Cloud SQL and AlloyDB with minimal downtime. |
| datapipelines.googleapis.com | Data Pipelines — Schedules and monitors recurring Dataflow streaming or batch pipelines. |
| dataplex.googleapis.com | Dataplex — Provides data management, governance, and discovery across distributed data lakes. |
| dataproc.googleapis.com | Dataproc — Runs managed Apache Spark, Hadoop, and Presto clusters for large-scale data processing. |
| datastore.googleapis.com | Cloud Datastore — Legacy NoSQL document database (auto-upgraded to Cloud Firestore in Datastore mode). |
| datastream.googleapis.com | Datastream — Serverless Change Data Capture (CDC) and replication tool for streaming DB updates. |
| deploymentmanager.googleapis.com | Deployment Manager — Infrastructure-as-code tool deploying GCP resources using YAML templates. |
| dialogflow.googleapis.com | Dialogflow — Builds conversational interfaces, virtual agents, and chatbots powered by generative AI. |
| discoveryengine.googleapis.com | Vertex AI Search and Conversation — Generative AI search and discovery engine for enterprise data. |
| dlp.googleapis.com | Cloud Data Loss Prevention — Inspects, classifies, and anonymizes sensitive data like PII and credit card numbers. |
| dns.googleapis.com | Cloud DNS — Reliable, low-latency Domain Name System (DNS) service for domain management. |
| documentai.googleapis.com | Document AI — Extracts structured fields and text from unstructured documents (PDFs, forms, invoices). |
| domains.googleapis.com | Cloud Domains — Registers, transfers, and manages custom domain names within Google Cloud. |
| essentialcontacts.googleapis.com | Essential Contacts — Manages administrative points of contact for automated Google system notifications. |
| eventarc.googleapis.com | Eventarc — Routes asynchronous events from GCP sources or custom services to target endpoints. |
| file.googleapis.com | Filestore — Fully managed Network Attached Storage (NAS) providing shared file systems (NFS) for applications. |
| firebaseappdistribution.googleapis.com | Firebase App Distribution — Releases pre-release builds of iOS and Android apps directly to beta testers. |
| firebasedatabase.googleapis.com | Firebase Realtime Database — Real-time NoSQL database syncing data across connected mobile and web clients. |
| firebasehosting.googleapis.com | Firebase Hosting — Fast, secure static and dynamic web content delivery across a global CDN. |
| firebaseremoteconfig.googleapis.com | Firebase Remote Config — Modifies application behavior and appearance dynamically without releasing app store updates. |
| firebaserules.googleapis.com | Firebase Security Rules — Configures authorization and input validation rules for Firebase databases and cloud storage. |
| firestore.googleapis.com | Cloud Firestore — Flexible, scalable NoSQL document database built for real-time mobile and web app syncing. |
| gkebackup.googleapis.com | Backup for GKE — Automates backing up and restoring Kubernetes workloads and persistent volume data. |
| gkehub.googleapis.com | GKE Fleet Management — Manages multiple Kubernetes clusters as unified fleets across hybrid and multi-cloud platforms. |
| healthcare.googleapis.com | Cloud Healthcare API — Stores and exchanges healthcare data using FHIR, DICOM, and HL7v2 standards. |
| iam.googleapis.com | Identity and Access Management — Controls authentication, roles, and granular access permissions across cloud resources. |
| iap.googleapis.com | Identity-Aware Proxy — Grants context-aware access to web apps and VMs without needing a traditional VPN. |
| identitytoolkit.googleapis.com | Identity Platform — Manages user authentication, multi-factor authentication, and identity federations for apps. |
| integrations.googleapis.com | Application Integration — Enterprise Integration Platform as a Service (iPaaS) for connecting apps without custom code. |
| logging.googleapis.com | Cloud Logging — Ingests, analyzes, and stores log data from GCP services and custom applications. |
| looker.googleapis.com | Looker — Business intelligence and data platform for visualizing and analyzing data across platforms. |
| managedidentities.googleapis.com | Managed Microsoft AD — Provides fully managed Microsoft Active Directory infrastructure on GCP. |
| managedkafka.googleapis.com | Managed Service for Apache Kafka — Fully managed streaming platform for Apache Kafka event workloads. |
| memcache.googleapis.com | Memorystore for Memcached — Managed, scalable in-memory key-value caching service. |
| metastore.googleapis.com | Dataproc Metastore — Fully managed Apache Hive metastore for tracking big data lake schemas. |
| ml.googleapis.com | AI Platform (Legacy) — Legacy machine learning service for training and hosting predictive models. |
| monitoring.googleapis.com | Cloud Monitoring — Tracks infrastructure performance metrics, uptime checks, dashboards, and operational alerts. |
| netapp.googleapis.com | NetApp Volumes — High-performance, fully managed NFS and SMB file storage service. |
| networkconnectivity.googleapis.com | Network Connectivity Center — Orchestrates multi-cloud and hybrid cloud networking using Google's global network backbone. |
| networksecurity.googleapis.com | Network Security API — Configures advanced network security rules, Cloud NGFW policies, and threat prevention. |
| networkservices.googleapis.com | Network Services — Configures traffic management, Service Mesh, and custom network extensions. |
| notebooks.googleapis.com | Vertex AI Workbench / Notebooks — Deploys managed Jupyter notebook environments for data science workflows. |
| orgpolicy.googleapis.com | Organization Policy API — Sets centralized guardrails and restrictions across Google Cloud organization hierarchies. |
| osconfig.googleapis.com | VM Manager / OS Config — Manages operating system patches, configuration management, and software licenses on compute instances. |
| policyanalyzer.googleapis.com | Policy Analyzer — Analyzes and audits IAM policies to discover access risks and permission paths. |
| privateca.googleapis.com | Certificate Authority Service — Simplifies creation and management of private Public Key Infrastructure (PKI) CAs. |
| pubsub.googleapis.com | Cloud Pub/Sub — Ingestion service for real-time asynchronous event streams and message queueing. |
| recaptchaenterprise.googleapis.com | reCAPTCHA Enterprise — Protects web apps from bots, fraud, credential stuffing, and scraping attacks. |
| recommender.googleapis.com | Recommender API — Delivers automated recommendations for security, cost optimization, and performance. |
| redis.googleapis.com | Memorystore for Redis — Fully managed in-memory data store for caching and sub-millisecond data retrieval. |
| run.googleapis.com | Cloud Run — Executes stateless containerized applications on a fully managed serverless platform. |
| secretmanager.googleapis.com | Secret Manager — Centralized storage for sensitive values like passwords, tokens, API keys, and certificates. |
| securitycenter.googleapis.com | Security Command Center — Centralized security posture management, risk evaluation, and threat detection. |
| servicedirectory.googleapis.com | Service Directory — Single catalog for discovering, registering, and resolving network services. |
| servicemanagement.googleapis.com | Service Management API — Manages service deployment specifications and API configuration settings across GCP. |
| serviceusage.googleapis.com | Service Usage API — Enables or disables Google Cloud APIs and checks resource quota limits. |
| sourcerepo.googleapis.com | Cloud Source Repositories — Hosted, private Git repositories with built-in integrations. |
| spanner.googleapis.com | Cloud Spanner — Globally distributed, horizontally scalable relational database with transactional consistency. |
| speech.googleapis.com | Speech-to-Text — Converts audio into written text using speech recognition models. |
| sqladmin.googleapis.com | Cloud SQL Admin — Provisions and manages relational database instances (MySQL, PostgreSQL, SQL Server). |
| storage.googleapis.com | Cloud Storage — Scalable, durable object storage for unstructured data, media files, and backups. |
| storagetransfer.googleapis.com | Storage Transfer Service — Moves bulk data quickly between cloud providers (AWS, Azure) or local storage to GCP. |
| tpu.googleapis.com | Cloud TPU — Provides Tensor Processing Unit hardware accelerators optimized for deep learning models. |
| translate.googleapis.com | Cloud Translation — Translates text into over 100 languages dynamically using Google ML models. |
| vmwareengine.googleapis.com | Google Cloud VMware Engine — Migrates and runs native VMware vSphere workloads directly on dedicated GCP hardware. |
| vpcaccess.googleapis.com | Serverless VPC Access — Enables serverless environments (Cloud Run, Functions) to connect privately to internal VPC resources. |
| websecurityscanner.googleapis.com | Web Security Scanner — Crawls and identifies common web security vulnerabilities in compute and App Engine apps. |
| workflows.googleapis.com | Workflows — Links and orchestrates multiple cloud APIs and HTTP endpoints into serverless workflows. |
| workstations.googleapis.com | Cloud Workstations — Managed cloud-based development environments for developer security and standardization. |