Google Service Networking API

Name: Service Networking API
Brand: Service Networking API
Availability: InStock

✓ Official Vendor SpecCloud InfrastructureNetworkingoauth225 Endpoints

Install Jentic One Beta

Connect the Service Networking API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Service Networking API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Service Networking API.

Create and update private VPC peering connections between a producer service and a consumer VPC

Allocate, list, and delete private IP ranges that producer services can use

Manage producer-side DNS zones and DNS records that resolve inside the consumer network

GET STARTED

Start building with Service Networking API

Explore with Jentic

View OpenAPI Document

For Agents

Configure private VPC peerings, allocated IP ranges, and DNS zones between Google's managed services and a consumer VPC.

Use for: Set up private services access for Cloud SQL on my VPC, Allocate a /16 internal range for a new managed service connection, List all VPC peerings my consumer project has with Google services, Delete a stale producer DNS zone

Not supported: Does not handle VPC creation, public load balancing, or general DNS administration - use for producer-consumer VPC peering, allocated ranges, and producer DNS for managed services only.

Use Cases

Patterns agents use Service Networking API for, with concrete tasks.

★ Private Services Access for Managed Databases

Provision the VPC peering and reserved IP range that Cloud SQL, Memorystore, AlloyDB, and similar managed services need to reach customer workloads on private IPs. Service Networking creates the producer-side network, peers it with the consumer VPC, and tracks the allocated ranges so the same setup can host many service instances.

Call POST /v1/services/{serviceName}/connections with the consumer VPC network and reservedPeeringRanges set to the allocated range name.

Network Range Lifecycle Management

Allocate, expand, and reclaim private IP ranges as your portfolio of managed services grows. The API exposes addRoles and removePrivateUsedIpRange-style operations under the connections resource, plus IP range management on the consumer side, so operators can extend ranges without manually editing route tables.

Call PATCH /v1/services/{serviceName}/connections/{connectionId} with reservedPeeringRanges updated to include the new range, then poll the long-running operation.

Hybrid DNS Resolution

Configure producer-side DNS zones and records so that consumer workloads resolve managed-service hostnames inside the peered network without leaking through public DNS. Use the dnsRecordSets and dnsZones operations to add CNAMEs, manage forwarding behaviour, and audit records over time.

Call POST /v1/services/{serviceName}/projects/{projectNumber}/global/networks/{network}/dnsZones to create a private zone for the managed service domain.

AI Agent Network Provisioner

An AI agent automates network setup for new managed-service deployments - picking a non-overlapping range, creating the peering, configuring DNS, and reporting back when the long-running operation finishes. Through Jentic the agent searches for the right operation by intent and never holds the customer's GCP service account credentials directly.

Allocate a /20 range that does not collide with existing subnets, call services/{service}/connections to create the peering, then verify with services/{service}/connections.list.

Key Endpoints

25 endpoints — service networking automates the network plumbing required for managed google cloud services that need private connectivity into a customer's vpc, like cloud sql, memorystore, and alloydb.

METHOD

PATH

DESCRIPTION

POST

/v1/services/{serviceName}/connections

Create a VPC peering connection

GET

/v1/services/{serviceName}/connections

List existing connections

PATCH

/v1/services/{serviceName}/connections/{connectionId}

Update a connection's allocated ranges

POST

/v1/services/{serviceName}:addSubnetwork

Add a producer subnetwork to the connection

POST

/v1/services/{serviceName}/dnsZones:add

Add a producer DNS zone

POST

/v1/services/{serviceName}/dnsRecordSets:add

Add a DNS record set inside a producer zone

POST

/v1/services/{serviceName}/connections

Create a VPC peering connection

GET

/v1/services/{serviceName}/connections

List existing connections

PATCH

/v1/services/{serviceName}/connections/{connectionId}

Update a connection's allocated ranges

POST

/v1/services/{serviceName}:addSubnetwork

Add a producer subnetwork to the connection

POST

/v1/services/{serviceName}/dnsZones:add

Add a producer DNS zone

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Service Networking OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a private services access connection' or 'add an allocated range', and Jentic returns the matching Service Networking operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

Time to first call

FAQs

Specific to using Service Networking API through Jentic.

What authentication does the Service Networking API use?

It uses OAuth 2.0 with the cloud-platform or service.management scope and IAM permissions like roles/servicenetworking.networksAdmin on the consumer project. Through Jentic the credentials are stored encrypted in your Jentic One instance and a scoped token is provided at execution.

Which Google services use Service Networking under the hood?

Cloud SQL private IP, Memorystore for Redis, AlloyDB, Filestore, and several other managed services rely on Service Networking peerings to reach customer VPCs. The same API provisions all of them through the servicenetworking.googleapis.com producer.

What are the rate limits for the Service Networking API?

Google enforces a default per-project quota of 600 read requests per minute and 60 write requests per minute. Most write actions are long-running operations because peering and IP allocation involve VPC programming.

How do I create a private services access connection through Jentic?

Run the Jentic search query 'create a service networking connection', load POST /v1/services/{service}/connections, and execute it with the consumer network and reservedPeeringRanges. Jentic handles the OAuth token and operation polling.

Can I expand an allocated range without recreating the connection?

Yes. PATCH the connection with an updated reservedPeeringRanges list that includes the additional range. Service Networking widens the peering in place; existing service instances continue to work.

Does the API support VPC Service Controls?

Yes. The vpcServiceControls subresource on a connection lets you read and write the VPC-SC policy that governs traffic between the producer and consumer networks for that managed service.

Can I limit what my agent is allowed to do with the Service Networking API?

Yes. Because Service Networking puts the service name in the URL path, such as /v1/services/{serviceName}/connections, your self-hosted Jentic One instance can pin the agent to one peered service so it only creates and reads connections for that service. You decide which operations the agent may call, so actions like adding a subnetwork or a producer DNS zone stay off unless you allow them. The OAuth credential is stored encrypted by your own Jentic One and injected at execution, never entering the agent's prompt or logs.

Google Service Networking API

Connect the Service Networking API to your agent

Capabilities

Start building with Service Networking API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs