# Toolcape + Cloud IAM

Toolcape connects a company’s existing AI to its systems through one MCP entry point, with account connections, group and individual permissions, and audit logs. This documentation describes a product prototype; it is not evidence that a live server or account is connected.

## The connection
Cloud IAM: Permissions and service identities used by applications in Google Cloud.
API connection · AI uses Toolcape through MCP
Provider sign-in (OAuth). Confirm whether the configured connection acts as the user or uses application permissions.

## Typical actions
- Read: Inspect roles and service accounts
- Create: Create supported roles or service accounts
- Change: Change cloud access settings
Use with an IT administrator. This governs infrastructure permissions and is different from Toolcape’s member permissions.

## Setup
1. IT configures the provider app, API and requested scopes.
2. Provider sign-in (OAuth). Confirm whether the configured connection acts as the user or uses application permissions.
3. Make the service available in Toolcape. Set Everyone, group and individual rules for the actions actually needed. Adding a service does not grant access.
4. Connect the approved AI client to the actual Toolcape MCP address and sign in. Start with a harmless read-only task and check the audit log.

## Permissions
For personal delegated access, the provider account, approved app scopes and Toolcape rules must all permit the action. Shared accounts and application permissions may have other limits. Toolcape combines Everyone and group grants; a personal exception replaces inherited access for that service. Reading can disclose confidential information. Sharing, sending and deletion need separate consideration.

## Calling an operation
First discover which tools the connected Toolcape server actually exposes. If it offers search → describe → execute, find the relevant operation, inspect its input schema and permissions, then call it with validated inputs. Tool names vary by server; do not invent names, arguments, URLs or successful outcomes. Without connected tools, give setup guidance instead of claiming to perform actions.

## Operation reference
Catalog snapshot: 16 September 2026. Verify the current schema before calling.
- iamOrganizationsRolesGet — Get Organizations Roles
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamOrganizationsRolesDelete — Delete Organizations Roles
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamOrganizationsRolesPatch — Patch Organizations Roles
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamOrganizationsRolesList — List Organizations Roles
  GET https://iam.googleapis.com/v1/{+parent}/roles
  https://cloud.google.com/iam/
- iamOrganizationsRolesCreate — Create Organizations Roles
  POST https://iam.googleapis.com/v1/{+parent}/roles
  https://cloud.google.com/iam/
- iamOrganizationsRolesUndelete — Organizations Roles Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamPermissionsQueryTestablePermissions — Permissions Query Testable Permissions
  POST https://iam.googleapis.com/v1/permissions:queryTestablePermissions
  https://cloud.google.com/iam/
- iamProjectsRolesGet — Get Projects Roles
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsRolesDelete — Delete Projects Roles
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsRolesPatch — Patch Projects Roles
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsRolesList — List Projects Roles
  GET https://iam.googleapis.com/v1/{+parent}/roles
  https://cloud.google.com/iam/
- iamProjectsRolesCreate — Create Projects Roles
  POST https://iam.googleapis.com/v1/{+parent}/roles
  https://cloud.google.com/iam/
- iamProjectsRolesUndelete — Projects Roles Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsGet — Get Projects Service Accounts
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsUpdate — Update Projects Service Accounts
  PUT https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsDelete — Delete Projects Service Accounts
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsPatch — Patch Projects Service Accounts
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsUndelete — Projects Service Accounts Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsDisable — Projects Service Accounts Disable
  POST https://iam.googleapis.com/v1/{+name}:disable
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsSignBlob — Projects Service Accounts Sign Blob
  POST https://iam.googleapis.com/v1/{+name}:signBlob
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsSetIamPolicy — Set Projects Service Accounts Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:setIamPolicy
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsList — List Projects Service Accounts
  GET https://iam.googleapis.com/v1/{+name}/serviceAccounts
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsCreate — Create Projects Service Accounts
  POST https://iam.googleapis.com/v1/{+name}/serviceAccounts
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsSignJwt — Projects Service Accounts Sign Jwt
  POST https://iam.googleapis.com/v1/{+name}:signJwt
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsTestIamPermissions — Projects Service Accounts Test Iam Permissions
  POST https://iam.googleapis.com/v1/{+resource}:testIamPermissions
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsEnable — Projects Service Accounts Enable
  POST https://iam.googleapis.com/v1/{+name}:enable
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsGetIamPolicy — Get Projects Service Accounts Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:getIamPolicy
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysGet — Get Projects Service Accounts Keys
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysDelete — Delete Projects Service Accounts Keys
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysDisable — Projects Service Accounts Keys Disable
  POST https://iam.googleapis.com/v1/{+name}:disable
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysList — List Projects Service Accounts Keys
  GET https://iam.googleapis.com/v1/{+name}/keys
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysCreate — Create Projects Service Accounts Keys
  POST https://iam.googleapis.com/v1/{+name}/keys
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysUpload — Projects Service Accounts Keys Upload
  POST https://iam.googleapis.com/v1/{+name}/keys:upload
  https://cloud.google.com/iam/
- iamProjectsServiceAccountsKeysEnable — Projects Service Accounts Keys Enable
  POST https://iam.googleapis.com/v1/{+name}:enable
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsUndelete — Projects Locations Oauth Clients Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsList — List Projects Locations Oauth Clients
  GET https://iam.googleapis.com/v1/{+parent}/oauthClients
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsCreate — Create Projects Locations Oauth Clients
  POST https://iam.googleapis.com/v1/{+parent}/oauthClients
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsGet — Get Projects Locations Oauth Clients
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsDelete — Delete Projects Locations Oauth Clients
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsPatch — Patch Projects Locations Oauth Clients
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsCredentialsGet — Get Projects Locations Oauth Clients Credentials
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsCredentialsDelete — Delete Projects Locations Oauth Clients Credentials
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsCredentialsPatch — Patch Projects Locations Oauth Clients Credentials
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsCredentialsList — List Projects Locations Oauth Clients Credentials
  GET https://iam.googleapis.com/v1/{+parent}/credentials
  https://cloud.google.com/iam/
- iamProjectsLocationsOauthClientsCredentialsCreate — Create Projects Locations Oauth Clients Credentials
  POST https://iam.googleapis.com/v1/{+parent}/credentials
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsGet — Get Projects Locations Workload Identity Pools
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsDelete — Delete Projects Locations Workload Identity Pools
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsPatch — Patch Projects Locations Workload Identity Pools
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsUndelete — Projects Locations Workload Identity Pools Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsAddAttestationRule — Add Projects Locations Workload Identity Pools Attestation Rule
  POST https://iam.googleapis.com/v1/{+resource}:addAttestationRule
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsSetIamPolicy — Set Projects Locations Workload Identity Pools Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:setIamPolicy
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsRemoveAttestationRule — Remove Projects Locations Workload Identity Pools Attestation Rule
  POST https://iam.googleapis.com/v1/{+resource}:removeAttestationRule
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsGetIamPolicy — Get Projects Locations Workload Identity Pools Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:getIamPolicy
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsTestIamPermissions — Projects Locations Workload Identity Pools Test Iam Permissions
  POST https://iam.googleapis.com/v1/{+resource}:testIamPermissions
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsList — List Projects Locations Workload Identity Pools
  GET https://iam.googleapis.com/v1/{+parent}/workloadIdentityPools
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsCreate — Create Projects Locations Workload Identity Pools
  POST https://iam.googleapis.com/v1/{+parent}/workloadIdentityPools
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsListAttestationRules — List Projects Locations Workload Identity Pools Attestation Rules
  GET https://iam.googleapis.com/v1/{+resource}:listAttestationRules
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsSetAttestationRules — Set Projects Locations Workload Identity Pools Attestation Rules
  POST https://iam.googleapis.com/v1/{+resource}:setAttestationRules
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesUndelete — Projects Locations Workload Identity Pools Namespaces Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesGet — Get Projects Locations Workload Identity Pools Namespaces
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesDelete — Delete Projects Locations Workload Identity Pools Namespaces
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesPatch — Patch Projects Locations Workload Identity Pools Namespaces
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesList — List Projects Locations Workload Identity Pools Namespaces
  GET https://iam.googleapis.com/v1/{+parent}/namespaces
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesCreate — Create Projects Locations Workload Identity Pools Namespaces
  POST https://iam.googleapis.com/v1/{+parent}/namespaces
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesOperationsGet — Get Projects Locations Workload Identity Pools Namespaces Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesAddAttestationRule — Add Projects Locations Workload Identity Pools Namespaces Managed Identities Attestation Rule
  POST https://iam.googleapis.com/v1/{+resource}:addAttestationRule
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesList — List Projects Locations Workload Identity Pools Namespaces Managed Identities
  GET https://iam.googleapis.com/v1/{+parent}/managedIdentities
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesCreate — Create Projects Locations Workload Identity Pools Namespaces Managed Identities
  POST https://iam.googleapis.com/v1/{+parent}/managedIdentities
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesGet — Get Projects Locations Workload Identity Pools Namespaces Managed Identities
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesDelete — Delete Projects Locations Workload Identity Pools Namespaces Managed Identities
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesPatch — Patch Projects Locations Workload Identity Pools Namespaces Managed Identities
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesRemoveAttestationRule — Remove Projects Locations Workload Identity Pools Namespaces Managed Identities Attestation Rule
  POST https://iam.googleapis.com/v1/{+resource}:removeAttestationRule
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesListAttestationRules — List Projects Locations Workload Identity Pools Namespaces Managed Identities Attestation Rules
  GET https://iam.googleapis.com/v1/{+resource}:listAttestationRules
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesSetAttestationRules — Set Projects Locations Workload Identity Pools Namespaces Managed Identities Attestation Rules
  POST https://iam.googleapis.com/v1/{+resource}:setAttestationRules
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesUndelete — Projects Locations Workload Identity Pools Namespaces Managed Identities Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesWorkloadSourcesOperationsGet — Get Projects Locations Workload Identity Pools Namespaces Managed Identities Workload Sources Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsNamespacesManagedIdentitiesOperationsGet — Get Projects Locations Workload Identity Pools Namespaces Managed Identities Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersUndelete — Projects Locations Workload Identity Pools Providers Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersList — List Projects Locations Workload Identity Pools Providers
  GET https://iam.googleapis.com/v1/{+parent}/providers
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersCreate — Create Projects Locations Workload Identity Pools Providers
  POST https://iam.googleapis.com/v1/{+parent}/providers
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersGet — Get Projects Locations Workload Identity Pools Providers
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersDelete — Delete Projects Locations Workload Identity Pools Providers
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersPatch — Patch Projects Locations Workload Identity Pools Providers
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersKeysList — List Projects Locations Workload Identity Pools Providers Keys
  GET https://iam.googleapis.com/v1/{+parent}/keys
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersKeysCreate — Create Projects Locations Workload Identity Pools Providers Keys
  POST https://iam.googleapis.com/v1/{+parent}/keys
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersKeysGet — Get Projects Locations Workload Identity Pools Providers Keys
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersKeysDelete — Delete Projects Locations Workload Identity Pools Providers Keys
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersKeysUndelete — Projects Locations Workload Identity Pools Providers Keys Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersKeysOperationsGet — Get Projects Locations Workload Identity Pools Providers Keys Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsProvidersOperationsGet — Get Projects Locations Workload Identity Pools Providers Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamProjectsLocationsWorkloadIdentityPoolsOperationsGet — Get Projects Locations Workload Identity Pools Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsUndelete — Locations Workforce Pools Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsGetIamPolicy — Get Locations Workforce Pools Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:getIamPolicy
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsGet — Get Locations Workforce Pools
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsDelete — Delete Locations Workforce Pools
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsPatch — Patch Locations Workforce Pools
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsList — List Locations Workforce Pools
  GET https://iam.googleapis.com/v1/{+location}/workforcePools
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsCreate — Create Locations Workforce Pools
  POST https://iam.googleapis.com/v1/{+location}/workforcePools
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsSetIamPolicy — Set Locations Workforce Pools Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:setIamPolicy
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsTestIamPermissions — Locations Workforce Pools Test Iam Permissions
  POST https://iam.googleapis.com/v1/{+resource}:testIamPermissions
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersUndelete — Locations Workforce Pools Providers Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersGet — Get Locations Workforce Pools Providers
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersDelete — Delete Locations Workforce Pools Providers
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersPatch — Patch Locations Workforce Pools Providers
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersList — List Locations Workforce Pools Providers
  GET https://iam.googleapis.com/v1/{+parent}/providers
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersCreate — Create Locations Workforce Pools Providers
  POST https://iam.googleapis.com/v1/{+parent}/providers
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsGet — Get Locations Workforce Pools Providers Scim Tenants
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsDelete — Delete Locations Workforce Pools Providers Scim Tenants
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsPatch — Patch Locations Workforce Pools Providers Scim Tenants
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsList — List Locations Workforce Pools Providers Scim Tenants
  GET https://iam.googleapis.com/v1/{+parent}/scimTenants
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsCreate — Create Locations Workforce Pools Providers Scim Tenants
  POST https://iam.googleapis.com/v1/{+parent}/scimTenants
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsSetIamPolicy — Set Locations Workforce Pools Providers Scim Tenants Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:setIamPolicy
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsTestIamPermissions — Locations Workforce Pools Providers Scim Tenants Test Iam Permissions
  POST https://iam.googleapis.com/v1/{+resource}:testIamPermissions
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsGetIamPolicy — Get Locations Workforce Pools Providers Scim Tenants Iam Policy
  POST https://iam.googleapis.com/v1/{+resource}:getIamPolicy
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsUndelete — Locations Workforce Pools Providers Scim Tenants Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsTokensGet — Get Locations Workforce Pools Providers Scim Tenants Tokens
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsTokensDelete — Delete Locations Workforce Pools Providers Scim Tenants Tokens
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsTokensPatch — Patch Locations Workforce Pools Providers Scim Tenants Tokens
  PATCH https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsTokensList — List Locations Workforce Pools Providers Scim Tenants Tokens
  GET https://iam.googleapis.com/v1/{+parent}/tokens
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersScimTenantsTokensCreate — Create Locations Workforce Pools Providers Scim Tenants Tokens
  POST https://iam.googleapis.com/v1/{+parent}/tokens
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersOperationsGet — Get Locations Workforce Pools Providers Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersKeysUndelete — Locations Workforce Pools Providers Keys Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersKeysList — List Locations Workforce Pools Providers Keys
  GET https://iam.googleapis.com/v1/{+parent}/keys
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersKeysCreate — Create Locations Workforce Pools Providers Keys
  POST https://iam.googleapis.com/v1/{+parent}/keys
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersKeysGet — Get Locations Workforce Pools Providers Keys
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersKeysDelete — Delete Locations Workforce Pools Providers Keys
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsProvidersKeysOperationsGet — Get Locations Workforce Pools Providers Keys Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsSubjectsUndelete — Locations Workforce Pools Subjects Undelete
  POST https://iam.googleapis.com/v1/{+name}:undelete
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsSubjectsDelete — Delete Locations Workforce Pools Subjects
  DELETE https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsSubjectsOperationsGet — Get Locations Workforce Pools Subjects Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamLocationsWorkforcePoolsOperationsGet — Get Locations Workforce Pools Operations
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamRolesQueryGrantableRoles — Roles Query Grantable Roles
  POST https://iam.googleapis.com/v1/roles:queryGrantableRoles
  https://cloud.google.com/iam/
- iamRolesList — List Roles
  GET https://iam.googleapis.com/v1/roles
  https://cloud.google.com/iam/
- iamRolesGet — Get Roles
  GET https://iam.googleapis.com/v1/{+name}
  https://cloud.google.com/iam/
- iamIamPoliciesQueryAuditableServices — Iam Policies Query Auditable Services
  POST https://iam.googleapis.com/v1/iamPolicies:queryAuditableServices
  https://cloud.google.com/iam/
- iamIamPoliciesLintPolicy — Iam Policies Lint Policy
  POST https://iam.googleapis.com/v1/iamPolicies:lintPolicy
  https://cloud.google.com/iam/

## A useful first question
Which permissions does this service account have?

## If it fails
Check the account, expired authorization, app approval, provider scopes and Toolcape permissions. Share only redacted errors with support. Never paste passwords, tokens or client secrets into an AI conversation.