google-cloud

Google Cloud

Use Google Cloud REST APIs for the same broad resource management surfaces commonly reached through gcloud: projects, IAM, enabled APIs, compute, storage, data, deployment, logs, and billing.

Official docs: https://cloud.google.com/apis/docs/overview gcloud overview: https://cloud.google.com/sdk/gcloud

When to Use

Use this skill when you need to:

Discover accessible Google Cloud projects and their IAM policies
Inspect enabled APIs and common infrastructure resources
Work with Compute Engine, Cloud Storage, BigQuery, Cloud Run, GKE, Cloud Build, Artifact Registry, Secret Manager, Logging, Monitoring, Pub/Sub, Firestore, Spanner, Cloud SQL, or billing APIs
Translate a gcloud task into direct REST API calls

Prerequisites

Connect the Google Cloud connector at app.vm0.ai/connectors.

The access token is injected as $GOOGLE_CLOUD_TOKEN. The connector is not bound to a single project; Google IAM roles, enabled APIs, and organization policies decide which projects and resources are visible.

Troubleshooting: If requests fail, run zero doctor check-connector --env-name GOOGLE_CLOUD_TOKEN or zero doctor check-connector --url https://cloudresourcemanager.googleapis.com/v3/projects:search --method GET

API Surfaces

The Google Cloud connector is authorized for these API hosts:

https://cloudresourcemanager.googleapis.com
https://serviceusage.googleapis.com
https://iam.googleapis.com
https://compute.googleapis.com
https://appengine.googleapis.com
https://sqladmin.googleapis.com
https://bigquery.googleapis.com
https://storage.googleapis.com
https://run.googleapis.com
https://cloudbuild.googleapis.com
https://artifactregistry.googleapis.com
https://container.googleapis.com
https://cloudfunctions.googleapis.com
https://secretmanager.googleapis.com
https://logging.googleapis.com
https://monitoring.googleapis.com
https://cloudbilling.googleapis.com
https://pubsub.googleapis.com
https://firestore.googleapis.com
https://spanner.googleapis.com

Common gcloud equivalents:

gcloud task	REST API
`gcloud projects list`	`GET https://cloudresourcemanager.googleapis.com/v3/projects:search`
`gcloud projects get-iam-policy`	`POST https://cloudresourcemanager.googleapis.com/v3/projects/{project}:getIamPolicy`
`gcloud services list`	`GET https://serviceusage.googleapis.com/v1/projects/{project-number}/services`
`gcloud iam service-accounts list`	`GET https://iam.googleapis.com/v1/projects/{project-id}/serviceAccounts`
`gcloud compute instances list`	`GET https://compute.googleapis.com/compute/v1/projects/{project-id}/aggregated/instances`
`gcloud storage buckets list`	`GET https://storage.googleapis.com/storage/v1/b?project={project-id}`
`bq ls`	`GET https://bigquery.googleapis.com/bigquery/v2/projects/{project-id}/datasets`
`gcloud run services list`	`GET https://run.googleapis.com/v2/projects/{project-id}/locations/{region}/services`
`gcloud container clusters list`	`GET https://container.googleapis.com/v1/projects/{project-id}/locations/-/clusters`
`gcloud builds list`	`GET https://cloudbuild.googleapis.com/v1/projects/{project-id}/builds`
`gcloud artifacts repositories list`	`GET https://artifactregistry.googleapis.com/v1/projects/{project-id}/locations/{location}/repositories`
`gcloud secrets list`	`GET https://secretmanager.googleapis.com/v1/projects/{project-id}/secrets`
`gcloud logging read`	`POST https://logging.googleapis.com/v2/entries:list`
`gcloud monitoring metrics descriptors list`	`GET https://monitoring.googleapis.com/v3/projects/{project-id}/metricDescriptors`

Projects and IAM

Search Accessible Projects

curl -s "https://cloudresourcemanager.googleapis.com/v3/projects:search?pageSize=20" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.projects[]? | {name, projectId, displayName, state, parent}'

Get Project Metadata

Use name from the project search response, for example projects/123456789012.

curl -s "https://cloudresourcemanager.googleapis.com/v3/projects/{project-number}" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '{name, projectId, displayName, state, parent, createTime, updateTime}'

Get Project IAM Policy

Write to /tmp/google_cloud_get_iam_policy.json:

{}

Then run:

curl -s -X POST "https://cloudresourcemanager.googleapis.com/v3/projects/{project-id-or-number}:getIamPolicy" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" --header "Content-Type: application/json" -d @/tmp/google_cloud_get_iam_policy.json | jq '.bindings[]? | {role, members}'

Test Project Permissions

Write to /tmp/google_cloud_test_permissions.json:

{
  "permissions": [
    "resourcemanager.projects.get",
    "serviceusage.services.list",
    "compute.instances.list",
    "run.services.list"
  ]
}

Then run:

curl -s -X POST "https://cloudresourcemanager.googleapis.com/v3/projects/{project-id-or-number}:testIamPermissions" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" --header "Content-Type: application/json" -d @/tmp/google_cloud_test_permissions.json | jq '.permissions // []'

List Service Accounts

curl -s "https://iam.googleapis.com/v1/projects/{project-id}/serviceAccounts?pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.accounts[]? | {name, email, displayName, disabled}'

Enabled APIs

Service Usage commonly requires the numeric project number in the path. Get it from projects:search first.

List Enabled APIs

curl -s "https://serviceusage.googleapis.com/v1/projects/{project-number}/services?filter=state:ENABLED&pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.services[]? | {name, title: .config.title, state}'

Enable an API

Only run this after the user confirms the project and API name.

curl -s -X POST "https://serviceusage.googleapis.com/v1/projects/{project-number}/services/run.googleapis.com:enable" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" --header "Content-Type: application/json" -d '{}' | jq '{name, done, error}'

Compute Engine

List Zones

curl -s "https://compute.googleapis.com/compute/v1/projects/{project-id}/zones" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.items[]? | {name, status, region}'

List VM Instances Across All Zones

curl -s "https://compute.googleapis.com/compute/v1/projects/{project-id}/aggregated/instances?maxResults=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.items | to_entries[] | select(.value.instances) | {scope: .key, instances: [.value.instances[] | {name, status, machineType, zone, networkInterfaces}]}'

List VM Instances in One Zone

curl -s "https://compute.googleapis.com/compute/v1/projects/{project-id}/zones/{zone}/instances?maxResults=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.items[]? | {name, status, machineType, zone, creationTimestamp}'

Cloud Storage

List Buckets

curl -s "https://storage.googleapis.com/storage/v1/b?project={project-id}&maxResults=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.items[]? | {name, location, storageClass, timeCreated}'

List Objects in a Bucket

curl -s "https://storage.googleapis.com/storage/v1/b/{bucket-name}/o?maxResults=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.items[]? | {name, size, contentType, updated}'

Download an Object

curl -s "https://storage.googleapis.com/storage/v1/b/{bucket-name}/o/{object-name-url-encoded}?alt=media" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" --output /tmp/google_cloud_object.bin

BigQuery

List Datasets

curl -s "https://bigquery.googleapis.com/bigquery/v2/projects/{project-id}/datasets?maxResults=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.datasets[]? | {id, datasetReference, location, friendlyName}'

List Tables

curl -s "https://bigquery.googleapis.com/bigquery/v2/projects/{project-id}/datasets/{dataset-id}/tables?maxResults=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.tables[]? | {id, type, tableReference, creationTime}'

Run a Query

Write to /tmp/google_cloud_bigquery_query.json:

{
  "query": "SELECT CURRENT_DATE() AS today",
  "useLegacySql": false
}

Then run:

curl -s -X POST "https://bigquery.googleapis.com/bigquery/v2/projects/{project-id}/queries" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" --header "Content-Type: application/json" -d @/tmp/google_cloud_bigquery_query.json | jq '{jobComplete, schema, rows}'

Application Hosting and Deployments

List Cloud Run Services

curl -s "https://run.googleapis.com/v2/projects/{project-id}/locations/{region}/services?pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.services[]? | {name, uri, latestReadyRevision, ingress, createTime, updateTime}'

List GKE Clusters

Use location - to match all zones and regions.

curl -s "https://container.googleapis.com/v1/projects/{project-id}/locations/-/clusters" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.clusters[]? | {name, location, status, currentMasterVersion, currentNodeVersion}'

List Cloud Build Builds

curl -s "https://cloudbuild.googleapis.com/v1/projects/{project-id}/builds?pageSize=20" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.builds[]? | {id, status, createTime, finishTime, logUrl}'

List Artifact Registry Repositories

curl -s "https://artifactregistry.googleapis.com/v1/projects/{project-id}/locations/{location}/repositories?pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.repositories[]? | {name, format, description, createTime, updateTime}'

List Cloud Functions

curl -s "https://cloudfunctions.googleapis.com/v2/projects/{project-id}/locations/{location}/functions?pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.functions[]? | {name, state, updateTime, url: .serviceConfig.uri}'

List App Engine Services

curl -s "https://appengine.googleapis.com/v1/apps/{project-id}/services?pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.services[]? | {id, name, split}'

Data and Messaging

List Pub/Sub Topics

curl -s "https://pubsub.googleapis.com/v1/projects/{project-id}/topics" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.topics[]? | {name}'

List Firestore Databases

curl -s "https://firestore.googleapis.com/v1/projects/{project-id}/databases" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.databases[]? | {name, locationId, type, concurrencyMode, appEngineIntegrationMode}'

List Spanner Instances

curl -s "https://spanner.googleapis.com/v1/projects/{project-id}/instances" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.instances[]? | {name, config, displayName, state}'

List Cloud SQL Instances

curl -s "https://sqladmin.googleapis.com/sql/v1beta4/projects/{project-id}/instances" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.items[]? | {name, databaseVersion, region, state, connectionName}'

Security, Logs, and Metrics

List Secrets

curl -s "https://secretmanager.googleapis.com/v1/projects/{project-id}/secrets?pageSize=50" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.secrets[]? | {name, labels, createTime, replication}'

Access a Secret Version

Only read secret payloads when the user explicitly asks for that secret. The payload is base64-encoded in .payload.data.

curl -s "https://secretmanager.googleapis.com/v1/projects/{project-id}/secrets/{secret-id}/versions/latest:access" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '{name, data: .payload.data}'

Query Recent Logs

Write to /tmp/google_cloud_logs_query.json:

{
  "resourceNames": ["projects/{project-id}"],
  "filter": "timestamp >= \"2026-06-10T00:00:00Z\"",
  "orderBy": "timestamp desc",
  "pageSize": 20
}

Then run:

curl -s -X POST "https://logging.googleapis.com/v2/entries:list" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" --header "Content-Type: application/json" -d @/tmp/google_cloud_logs_query.json | jq '.entries[]? | {timestamp, severity, logName, resource, textPayload, jsonPayload}'

List Monitoring Metric Descriptors

curl -s "https://monitoring.googleapis.com/v3/projects/{project-id}/metricDescriptors?pageSize=20" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '.metricDescriptors[]? | {type, metricKind, valueType, displayName}'

Billing

Get Project Billing Info

curl -s "https://cloudbilling.googleapis.com/v1/projects/{project-id}/billingInfo" --header "Authorization: Bearer $GOOGLE_CLOUD_TOKEN" | jq '{name, billingAccountName, billingEnabled, projectId}'

Guidelines

Discover projects first with Cloud Resource Manager before using project-specific APIs.
Use the project number where Service Usage or Resource Manager returns projects/{number}; use the project ID where product APIs document {project} or {projectId}.
Check enabled APIs before assuming a product endpoint is usable.
Google IAM is the source of truth for permissions. A connected OAuth token does not bypass IAM, organization policy, VPC Service Controls, or API enablement.
Prefer read-only inspection before mutations. Ask for explicit confirmation before enabling APIs, changing IAM, creating resources, deleting resources, or reading secret payloads.
Handle pagination with nextPageToken or pageToken for large projects.
Use URL encoding for bucket object names, filters, and labels that contain slashes, spaces, quotes, or special characters.

About this skill

When to Use

Prerequisites

API Surfaces

Projects and IAM

Search Accessible Projects

Get Project Metadata

Get Project IAM Policy

Test Project Permissions

List Service Accounts

Enabled APIs

List Enabled APIs

Enable an API

Compute Engine

List Zones

List VM Instances Across All Zones

List VM Instances in One Zone

Cloud Storage

List Buckets

List Objects in a Bucket

Download an Object

BigQuery

List Datasets

List Tables

Run a Query

Application Hosting and Deployments

List Cloud Run Services

List GKE Clusters

List Cloud Build Builds

List Artifact Registry Repositories

List Cloud Functions

List App Engine Services

Data and Messaging

List Pub/Sub Topics

List Firestore Databases

List Spanner Instances

List Cloud SQL Instances

Security, Logs, and Metrics

List Secrets

Access a Secret Version

Query Recent Logs

List Monitoring Metric Descriptors

Billing

Get Project Billing Info

Guidelines