[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698ZBX7MD2FX1WQ9AXB0X7Z":3,"skill-same:01M698ZBX7MD2FX1WQ9AXB0X7Z":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M698ZBX7MD2FX1WQ9AXB0X7Z","application-integration-basics",null,"Explains Google Cloud Application Integration concepts, region provisioning, IAM roles, run-as service accounts, interface choices (REST, Python discovery client, Terraform, ADK), and platform limits. Use when setting up Application Integration in a Google Cloud project, enabling required APIs, provisioning a region, configuring IAM or run-as service accounts, choosing between Application Integration and custom code, or checking quotas and timeouts. Do not use for building, publishing, or invoking integrations (use application-integration-authoring) or diagnosing failed or stuck runs and logs (use application-integration-troubleshooting).","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24044,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,9,37,38,39,40,41,42,43],"application integration basics","integration","application","basics","up","when","limits","concepts","interface","as","authoring","project","do","iam","logs","code","run","google cloud","adk","python","2026-11-10 10:12:30",false,"---\nname: application-integration-basics\nmetadata:\n  version: \"1.0.2\"\n  category: ApplicationDevelopment\ndescription: >-\n  Explains Google Cloud Application Integration concepts, region provisioning, IAM roles,\n  run-as service accounts, interface choices (REST, Python discovery client, Terraform, ADK),\n  and platform limits. Use when setting up Application Integration in a Google Cloud project,\n  enabling required APIs, provisioning a region, configuring IAM or run-as service accounts,\n  choosing between Application Integration and custom code, or checking quotas and timeouts.\n  Do not use for building, publishing, or invoking integrations (use application-integration-authoring) or diagnosing failed or stuck runs and logs (use application-integration-troubleshooting).\n---\n\n# Application Integration Basics\n\nApplication Integration is Google Cloud's serverless, auto-scaling Integration-Platform-as-a-Service (iPaaS) for connecting Google Cloud services and third-party SaaS applications. It runs event-driven workflows made of triggers, tasks, data mappings, and Integration Connectors connections without requiring you to manage servers. Use this skill to decide whether Application Integration fits a workload, set up a project and region, configure IAM and run-as service accounts, choose the right API or tool interface, and design around platform limits.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud` command, REST API call, or Python\ndiscovery-client call, you MUST read\n[Usage Attribution](references\u002Fattribution.md). For commands executed directly\nin the terminal (never in generated scripts, Terraform, ADK agents, or user\ncode), prefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:application-integration-basics)\"`\nand add `agent-skills\u002F1.0 (skill:application-integration-basics)` to the\n`User-Agent` header of `curl` requests.\n\n## When to Use Application Integration vs. Custom Glue Code\n\n| Choose Application Integration when... | Choose custom code (Cloud Run \u002F Cloud Functions) when... |\n| :--- | :--- |\n| Connecting SaaS apps (CRM, ERP, databases, Google Cloud services) via prebuilt Integration Connectors. | You need sub-second latency or custom binary protocols. |\n| Orchestrating event-driven workflows from API, Pub\u002FSub, Cloud Scheduler, Salesforce, or Connector Event triggers. | Total workflow data exceeds 30 MB (or 8 MB for API trigger inputs and Connector payloads). |\n| Transforming JSON\u002Farray data visually with Data Mapping or Jsonnet without deploying containers. | Synchronous runs take longer than 2 minutes or asynchronous runs take longer than 10 minutes. |\n| Pausing workflows for human review (`Approval` or `Suspend` tasks up to 31 days). | You must call VPC-only HTTP endpoints directly without Private Service Connect connectors (Call REST Endpoint reaches the public internet only). |\n| Exposing enterprise workflows or connectors as tools to AI agents via ADK `ApplicationIntegrationToolset`. | You need arbitrary language packages or heavy in-memory compute beyond JavaScript (V8) or Jsonnet tasks. |\n\n## Safety and Confirmation Rules\n\n- **Read-only checks run freely**: You may run `gcloud services list`, `gcloud projects get-iam-policy`, and HTTP `GET` calls to `https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002F...` or `https:\u002F\u002Fconnectors.googleapis.com\u002Fv1\u002F...` without asking first.\n- **Require explicit user confirmation before any state change**: Always show the exact command or request payload and wait for user approval before:\n  - Enabling APIs (`gcloud services enable`).\n  - Provisioning a region (`clients:provision` or `terraform apply` on `google_integrations_client`), especially with Customer-Managed Encryption Keys (CMEK), because **enabling CMEK for a region cannot be undone**.\n  - Modifying IAM policies (`gcloud projects add-iam-policy-binding` or `gcloud iam service-accounts add-iam-policy-binding`).\n  - Creating, uploading, publishing, unpublishing, executing, testing, or deleting any integration, version, auth profile, or connection.\n- **Never bundle destructive scripts** that delete integrations, versions, auth profiles, or connections unattended.\n- **Host changes require approval.** Before installing packages (`pip install`) or changing global gcloud or credential state (`gcloud config set ...` such as `auth\u002Fimpersonate_service_account`, `gcloud auth application-default login` \u002F `set-quota-project`), show the exact command and wait for the user's approval.\n\n## Choosing the Interface\n\nApplication Integration has **no `gcloud integrations` command group** (and no `gcloud connectors` command group), and **no Google-managed remote MCP server**. The REST API is the primary control and execution interface.\n\n| Interface | What it covers | Authentication |\n| :--- | :--- | :--- |\n| **REST API (`curl`)** | Full v1 surface: region provisioning, integrations, versions, download\u002Fupload, publish, execute, schedule, executions, suspensions, authConfigs, templates. | `Authorization: Bearer $(gcloud auth print-access-token)` |\n| **Python discovery client** | Full v1 surface via `googleapiclient.discovery.build(\"integrations\", \"v1\")` (and v2 via `build(\"integrations\", \"v2\")`; no dedicated Cloud Client Library exists). Install with `pip install \"google-api-python-client>=2.100.0,\u003C3\" \"google-auth>=2.20.0,\u003C3\"` (changes host or credential state; get the user's approval first). | Application Default Credentials (`gcloud auth application-default login`) (changes host or credential state; get the user's approval first) |\n| **Terraform (`hashicorp\u002Fgoogle`)** | Infrastructure only: `google_integrations_client` (region setup), `google_integrations_auth_config`, and `google_integration_connectors_*`. Does **not** manage integration workflow versions. | ADC or Terraform provider credentials |\n| **ADK (`ApplicationIntegrationToolset`)** | Exposes published API-trigger integrations or Integration Connectors actions\u002Fentities as tools for ADK agents (Python v0.1.0+, Java v0.3.0+). | ADC (`gcloud auth application-default login`) (changes host or credential state; get the user's approval first) or service account JSON |\n| **Cloud console** | Visual drag-and-drop editor, Quick\u002FAdvanced region setup, Approval task resolution, OAuth 2.0 authorization code consent flow. | Browser Google Cloud sign-in |\n\n- Use `gcloud` only for generic Google Cloud tasks: enabling APIs (`gcloud services enable`), printing access tokens (`gcloud auth print-access-token`), managing IAM, and reading Cloud Logging (`gcloud logging read`).\n- Integration Connectors includes an outbound **MCP connector** (`MCP v1` and `v2`) that lets a workflow call an external MCP server as a connector target; this is an outbound connector, not a Google-managed MCP server for controlling Application Integration.\n- Always use the global endpoint `https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002F...` consistently for REST calls.\n- **Note on draft testing (`integrations:test`)**: Although `POST ...\u002Fintegrations\u002FINTEGRATION_NAME:test` exists in the v1 REST API, its required `TestIntegrationsRequest.clientId` value is not publicly documented, so do not invent one; test integrations by publishing to a non-production project and calling `:execute`.\n- See [references\u002Fapi-access.md](references\u002Fapi-access.md) for authentication setup, `curl` commands, Python discovery client patterns, and ADK `ApplicationIntegrationToolset` configuration.\n\n## Step-by-Step Region Setup Workflow\n\nApplication Integration is regional: confirm the target region is supported on [Application Integration locations](https:\u002F\u002Fdocs.cloud.google.com\u002Fapplication-integration\u002Fdocs\u002Flocations.md.txt) and use `us-central1` as a well-supported default when the user has no preference. The region is the `LOCATION` in every REST path; no `gcloud` default-region setting applies to Application Integration. Provisioning is **per region**. Provisioning `us-central1` does not provision `europe-west1`; repeat region provisioning for every `LOCATION` you use in `PROJECT_ID`. Ensure an active billing account is attached to `PROJECT_ID` before setup—an active billing account is required even when usage stays within the monthly free tier (see the [Application Integration pricing page](https:\u002F\u002Fcloud.google.com\u002Fapplication-integration\u002Fpricing)).\n\n### 1. Check and enable required APIs\n\nFirst check which APIs are already enabled (read-only):\n\n```bash\ngcloud services list --enabled --project=PROJECT_ID \\\n  --filter=\"config.name:(integrations.googleapis.com OR connectors.googleapis.com OR secretmanager.googleapis.com OR cloudkms.googleapis.com)\"\n```\n\nAfter getting user confirmation, enable the required APIs (add `cloudkms.googleapis.com` only if configuring CMEK):\n\n```bash\ngcloud services enable \\\n  integrations.googleapis.com \\\n  connectors.googleapis.com \\\n  secretmanager.googleapis.com \\\n  --project=PROJECT_ID\n```\n\n### 2. Verify setup IAM roles on the caller\n\nSetting up Application Integration requires `roles\u002Fintegrations.integrationAdmin`, `roles\u002Fconnectors.admin`, and `roles\u002Feditor` (plus `roles\u002Fcloudkms.admin` for CMEK). Check current bindings (read-only):\n\n```bash\ngcloud projects get-iam-policy PROJECT_ID --format=json\n```\n\n### 3. Provision the region (`LOCATION`)\n\nChoose one of the three supported paths after getting user confirmation:\n\n- **Option A: REST (`clients:provision`)**\n  ```bash\n  curl -X POST \\\n    -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    -d '{}' \\\n    \"https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002Fclients:provision\"\n  ```\n  The response is `{}` when provisioning succeeds (`clients:provision` does not apply `runAsServiceAccount`; set the run-as identity on each integration version via `IntegrationVersion.runAsServiceAccount`). `{}` is also returned when the region is already provisioned; the call does not change an existing region's settings. Change HTTP calls or encryption on an existing region from the console's Regions page (when the region is already `ACTIVE`, `cloudKmsConfig`, `enableHttpCall`, and `enableManagedAiFeatures` on `clients:provision` are not applied). If `PROJECT_ID` was already registered through Apigee Integration, provisioning fails.\n\n- **Option B: Cloud console**\n  Open `https:\u002F\u002Fconsole.cloud.google.com\u002Fintegrations`, select `LOCATION`, and click **Quick setup** (enables the APIs, creates the default service account, and uses Google-managed encryption) or **Advanced setup** (to configure CMEK, HTTP calls, AI features, governance, or variable masking). To add another region later, go to **Regions > Provision new region**.\n\n- **Option C: Terraform (`google_integrations_client`)**\n  Use the `google_integrations_client` resource in `hashicorp\u002Fgoogle`. Do **not** set `run_as_service_account` on `google_integrations_client`—that argument was removed in provider v8.0.0 (August 26, 2026), and it mapped to the `clients:provision` `runAsServiceAccount` field, which is likewise not applied; set the run-as identity on each integration version (`IntegrationVersion.runAsServiceAccount`) instead.\n\n### 4. Sanity-check region access\n\nRun a read-only list call against the region; a successful `200 OK` response is a good sign that the API is reachable in `LOCATION`:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n  \"https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002Fintegrations\"\n```\n\nSee [references\u002Fprovisioning-and-terraform.md](references\u002Fprovisioning-and-terraform.md) for all `ProvisionClientRequest` fields, CMEK and governance options, and complete Terraform examples.\n\n## Core Concepts at a Glance\n\n- **Integrations and Triggers**: An integration is a workflow started by one or more triggers. Synchronous runs (`SYNC`) wait for completion and return output (`integrations.execute`, console test, sync `Call Integration`). Asynchronous runs (`ASYNC`) are fire-and-forget (`integrations.schedule`, Schedule, Cloud Scheduler, Cloud Pub\u002FSub, Salesforce triggers, and runs resumed after a suspension or approval).\n- **Tasks**: Units of work chained after a trigger (such as `Data Mapping`, `Call REST Endpoint`, `Connectors`, `JavaScript` on V8, `Cloud Function`, `Approval`, `Suspend`, `Timer`, loops, and `Call Integration`).\n- **Versions and Edit Locks**: Only a `DRAFT` version can be edited (locked to its author for 15 minutes after the last update). Only an `ACTIVE` (published) version runs from triggers. Publishing a version automatically unpublishes the prior active version and cancels any suspended executions of that prior version. Unpublishing moves an active version to `SNAPSHOT` (`PREVIOUSLY_PUBLISHED`). Calling `versions.delete` soft-deletes a version into `ARCHIVED` (listed as `DELETED` on the Integration versions documentation page).\n- **Variables**:\n  - **Integration variables**: Explicit inputs (`IN`), outputs (`OUT`), `IN_OUT`, or internal variables with `IN_OUT_TYPE_UNSPECIFIED` (`$varName$`).\n  - **Task variables**: Auto-generated task outputs named `` `Task_\u003CtaskId>_\u003CvariableName>` `` where `taskId` is the bare task number in `taskConfigs[].taskId` (for example, `taskId` `\"1\"` -> `` $`Task_1_responseBody`$ ``).\n  - **System variables**: keys are backtick-wrapped (`` `ExecutionId` ``, `` `ExecutionMode` ``, `` `ErrorInfo` `` [`message`, `code`], `` `IntegrationName` ``, `` `Region` ``, `` `ProjectId` ``); reference them as `` $`ExecutionId`$ `` (a bare `$ExecutionId$` names a nonexistent integration variable and fails).\n  - **Config variables** (Preview): Environment-specific values defined in `integrationConfigParameters` (with defaults in `parameter.defaultValue`; a top-level `value` on a draft is discarded) and supplied per environment in `configParameters` at publish time (named `` `CONFIG_\u003CNAME>` ``; keys in `configParameters` must **exactly match** a key in `integrationConfigParameters`, backticks included, such as `` \"`CONFIG_target_url`\" ``, because unknown keys are silently ignored—publish returns 200 and the default stays). **Never store secrets in config variables**—they are exported in plain text. Use an authentication profile (`authConfigs`) or the Secret Manager task instead.\n- **Suspensions**: `Suspend` tasks pause up to 31 days and are resumed via the Suspensions API (`suspensions:lift`, with an optional `suspensionResult`, requiring `integrations.suspensions.lift`). `Approval` tasks email approvers and can be approved or rejected in the Cloud console UI or via `suspensions:resolve` (`state`: `\"LIFTED\"` or `\"REJECTED\"`, requiring `integrations.suspensions.resolve`). Listing suspensions (`suspensions.list`) requires `integrations.suspensions.list`. All three permissions are included in `roles\u002Fintegrations.suspensionResolver` (and `roles\u002Fintegrations.integrationAdmin`), and resuming also requires `roles\u002Fiam.serviceAccountUser` on the integration's run-as service account; always confirm with the user before lifting or resolving. `Timer` tasks resume automatically.\n- **Authentication Profiles (`authConfigs`)**: Reusable regional credential records (`projects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002FauthConfigs\u002FAUTH_CONFIG_ID`). They are not included when downloading an integration version.\n\nSee [references\u002Fcore-concepts.md](references\u002Fcore-concepts.md) for full details on version states, trigger types, task categories, variables, suspensions, and authentication profiles.\n\n## IAM and the Run-As Service Account Requirement\n\n### Key IAM roles and service agents\n\n- **Developer & operator roles**: `roles\u002Fintegrations.integrationAdmin` (full CRUD + delete auth profiles), `roles\u002Fintegrations.integrationEditor` (create\u002Fupload\u002Fedit\u002Ftest\u002Finvoke\u002Fcancel\u002Freplay\u002Fpublish, including `integrations.integrationVersions.create` and `integrations.integrationVersions.deploy`), `roles\u002Fintegrations.integrationDeployer` (publish\u002Funpublish via `integrations.integrationVersions.deploy`; holds `list`\u002F`get`\u002F`deploy` but not `create`, so it can publish an existing version but cannot upload), `roles\u002Fintegrations.integrationInvoker` (invoke\u002Fcancel\u002Freplay), `roles\u002Fintegrations.integrationViewer` (view integrations and logs), and `roles\u002Fintegrations.suspensionResolver` (list, lift, and resolve suspensions: `integrations.suspensions.list`, `integrations.suspensions.lift`, `integrations.suspensions.resolve`; `suspensionResolver` alone cannot read execution records, so also grant `roles\u002Fintegrations.integrationViewer` to inspect `taskExecutionDetails` or run `:troubleshoot`, or use the approval email link, which carries the execution and task IDs).\n- **Service agents**:\n  - **Application Integration service agent**: `service-PROJECT_NUMBER@gcp-sa-integrations.iam.gserviceaccount.com` (granted `roles\u002Fintegrations.serviceAgent`).\n  - **Integration Connectors service agent**: `service-PROJECT_NUMBER@gcp-sa-connectors.iam.gserviceaccount.com` (granted `roles\u002Fconnectors.serviceAgent`).\n\n### Mandatory run-as service account rules (effective October 15, 2026)\n\n1. **Explicit identity required**: For integrations created on or after October 15, 2026 (and for existing integrations at a later date), every run needs an explicit identity—either the triggering caller or a user-managed run-as service account set per integration version via `IntegrationVersion.runAsServiceAccount` (region provisioning via `clients:provision` does not apply `runAsServiceAccount`).\n2. **Triggers other than API or Private require a run-as service account**: Integrations created on or after October 15, 2026 with any trigger other than an API or Private trigger (for example Schedule, Cloud Scheduler, Cloud Pub\u002FSub, Eventarc, Salesforce, or Connector Event) **cannot be tested or published unless `runAsServiceAccount` is set**. Private triggers are exempt like API triggers, so a sub-integration whose only trigger is Private can be published without `runAsServiceAccount`.\n3. **Region governance**: If governance is enabled on the region, a run-as service account is mandatory for **every** new integration and version, including API-trigger integrations.\n4. **Service Account User (`roles\u002Fiam.serviceAccountUser`)**: Whenever `runAsServiceAccount` is set on a version, the user (or principal) publishing or testing the version must hold `roles\u002Fiam.serviceAccountUser` on that service account (or its owning project). At runtime, the invoking caller or trigger service account—and anyone resolving or lifting a suspension—must also hold `roles\u002Fiam.serviceAccountUser` on it.\n5. **Best practice**: Create one dedicated, minimally scoped user-managed service account per integration. When `runAsServiceAccount` is set and no task-level auth profile is set, it mints tokens for Connector, Call REST Endpoint, and Cloud Function tasks (an OAuth 2.0 or OIDC auth profile on a task takes precedence over `runAsServiceAccount`).\n\nSee [references\u002Fiam-and-service-accounts.md](references\u002Fiam-and-service-accounts.md) for the complete IAM role tables, service agent permissions, credential precedence rules, and `gcloud` IAM commands.\n\n## Key Quotas and Limits to Design Around\n\n| Limit | Value | Design impact |\n| :--- | :--- | :--- |\n| **SYNC execution timeout** | 2 minutes | Use async triggers or `integrations.schedule` for workflows exceeding 2 minutes; timed-out sync runs become `CANCELLED`. |\n| **ASYNC execution timeout** | 10 minutes | Split heavy work into sub-integrations or external jobs if a single async run exceeds 10 minutes. |\n| **Max execution lifetime** | 31 days | Includes time paused in `Approval` or `Suspend` tasks (max 44,640 minutes). |\n| **Total integration data** | 30 MB | Shared across input\u002Foutput variables and private-trigger sub-integrations. **Above 10 MB, local logging is disabled**, retries stop working, and monitoring skips the run. |\n| **API trigger input size** | 8 MB | Cumulative size across all input variables; larger payloads fail before the workflow starts. |\n| **Connectors data & timeout** | 8 MB in\u002Fout; 3 min timeout | Application Integration quotas cap cumulative data sent to\u002Ffrom connections at 8 MB and connector response at 20 MB (Integration Connectors quotas cap the Connectors task payload at 10 MB); custom queries cap at 180 seconds and 50,000 rows. |\n| **Concurrent executions** | 50 per project per region; 10 per integration (defaults) | Both concurrency caps are adjustable; a burst on a single integration hits the 10-per-integration cap, not 50. The execution request rate quota is shown on the project's Cloud Quotas page and can be adjusted there. |\n| **Integrations \u002F tasks \u002F versions** | 1,000 \u002F 100 \u002F 100 | Up to 1,000 integrations per project, 100 tasks per integration, and 100 versions per integration. |\n| **Publish propagation** | Up to 10 minutes | Eventual consistency: an older version can keep running for up to 10 minutes after publishing a new version. |\n\nSee [references\u002Flimits.md](references\u002Flimits.md) for all task-specific payload caps, loop iteration limits, Integration Connectors node limits, and pricing details.\n\n## Sibling Skills\n\n- **application-integration-basics** (this skill): Concepts, API enablement, region provisioning, IAM roles and run-as service accounts, interface choices (REST, Python client, Terraform, ADK), and quotas\u002Flimits.\n- **application-integration-authoring**: Building, uploading, versioning, config variables, publishing, executing, and testing integrations via the REST API; trigger IDs; task gotchas; and CI\u002FCD promotion across projects with download\u002Fupload.\n- **application-integration-troubleshooting**: Diagnosing failed or stuck executions, checking execution and task states and `ErrorInfo`, listing and filtering executions, Cloud Logging and Cloud Monitoring, suspensions and approvals, Integration Connectors connection health, and IAM \u002F run-as \u002F quota errors.\n\n## Reference Files\n\n- [references\u002Fattribution.md](references\u002Fattribution.md): Usage attribution for `gcloud` CLI commands, direct `curl` REST calls, and Python discovery-client snippets run in the terminal.\n- [references\u002Fcore-concepts.md](references\u002Fcore-concepts.md): Triggers, execution modes, task types, version lifecycle, edit locks, variables, suspensions, and authentication profiles.\n- [references\u002Fiam-and-service-accounts.md](references\u002Fiam-and-service-accounts.md): Predefined IAM roles for Application Integration and Integration Connectors, service agents, run-as service account rules, and IAM commands.\n- [references\u002Fprovisioning-and-terraform.md](references\u002Fprovisioning-and-terraform.md): Per-region provisioning via REST `clients:provision`, Cloud console Quick\u002FAdvanced setup, CMEK caveats, and Terraform `google_integrations_*` \u002F `google_integration_connectors_*` resources.\n- [references\u002Fapi-access.md](references\u002Fapi-access.md): Endpoints, authentication, `curl` examples, Python `google-api-python-client` discovery patterns, ADK `ApplicationIntegrationToolset`, and MCP connector clarification.\n- [references\u002Flimits.md](references\u002Flimits.md): Timeouts, payload caps, concurrency quotas, loop\u002Ftask limits, Integration Connectors limits, and pricing tiers.\n","# Application Integration Basics\n\nApplication Integration is Google Cloud's serverless, auto-scaling Integration-Platform-as-a-Service (iPaaS) for connecting Google Cloud services and third-party SaaS applications. It runs event-driven workflows made of triggers, tasks, data mappings, and Integration Connectors connections without requiring you to manage servers. Use this skill to decide whether Application Integration fits a workload, set up a project and region, configure IAM and run-as service accounts, choose the right API or tool interface, and design around platform limits.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud` command, REST API call, or Python\ndiscovery-client call, you MUST read\n[Usage Attribution](references\u002Fattribution.md). For commands executed directly\nin the terminal (never in generated scripts, Terraform, ADK agents, or user\ncode), prefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:application-integration-basics)\"`\nand add `agent-skills\u002F1.0 (skill:application-integration-basics)` to the\n`User-Agent` header of `curl` requests.\n\n## When to Use Application Integration vs. Custom Glue Code\n\n| Choose Application Integration when... | Choose custom code (Cloud Run \u002F Cloud Functions) when... |\n| :--- | :--- |\n| Connecting SaaS apps (CRM, ERP, databases, Google Cloud services) via prebuilt Integration Connectors. | You need sub-second latency or custom binary protocols. |\n| Orchestrating event-driven workflows from API, Pub\u002FSub, Cloud Scheduler, Salesforce, or Connector Event triggers. | Total workflow data exceeds 30 MB (or 8 MB for API trigger inputs and Connector payloads). |\n| Transforming JSON\u002Farray data visually with Data Mapping or Jsonnet without deploying containers. | Synchronous runs take longer than 2 minutes or asynchronous runs take longer than 10 minutes. |\n| Pausing workflows for human review (`Approval` or `Suspend` tasks up to 31 days). | You must call VPC-only HTTP endpoints directly without Private Service Connect connectors (Call REST Endpoint reaches the public internet only). |\n| Exposing enterprise workflows or connectors as tools to AI agents via ADK `ApplicationIntegrationToolset`. | You need arbitrary language packages or heavy in-memory compute beyond JavaScript (V8) or Jsonnet tasks. |\n\n## Safety and Confirmation Rules\n\n- **Read-only checks run freely**: You may run `gcloud services list`, `gcloud projects get-iam-policy`, and HTTP `GET` calls to `https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002F...` or `https:\u002F\u002Fconnectors.googleapis.com\u002Fv1\u002F...` without asking first.\n- **Require explicit user confirmation before any state change**: Always show the exact command or request payload and wait for user approval before:\n  - Enabling APIs (`gcloud services enable`).\n  - Provisioning a region (`clients:provision` or `terraform apply` on `google_integrations_client`), especially with Customer-Managed Encryption Keys (CMEK), because **enabling CMEK for a region cannot be undone**.\n  - Modifying IAM policies (`gcloud projects add-iam-policy-binding` or `gcloud iam service-accounts add-iam-policy-binding`).\n  - Creating, uploading, publishing, unpublishing, executing, testing, or deleting any integration, version, auth profile, or connection.\n- **Never bundle destructive scripts** that delete integrations, versions, auth profiles, or connections unattended.\n- **Host changes require approval.** Before installing packages (`pip install`) or changing global gcloud or credential state (`gcloud config set ...` such as `auth\u002Fimpersonate_service_account`, `gcloud auth application-default login` \u002F `set-quota-project`), show the exact command and wait for the user's approval.\n\n## Choosing the Interface\n\nApplication Integration has **no `gcloud integrations` command group** (and no `gcloud connectors` command group), and **no Google-managed remote MCP server**. The REST API is the primary control and execution interface.\n\n| Interface | What it covers | Authentication |\n| :--- | :--- | :--- |\n| **REST API (`curl`)** | Full v1 surface: region provisioning, integrations, versions, download\u002Fupload, publish, execute, schedule, executions, suspensions, authConfigs, templates. | `Authorization: Bearer $(gcloud auth print-access-token)` |\n| **Python discovery client** | Full v1 surface via `googleapiclient.discovery.build(\"integrations\", \"v1\")` (and v2 via `build(\"integrations\", \"v2\")`; no dedicated Cloud Client Library exists). Install with `pip install \"google-api-python-client>=2.100.0,\u003C3\" \"google-auth>=2.20.0,\u003C3\"` (changes host or credential state; get the user's approval first). | Application Default Credentials (`gcloud auth application-default login`) (changes host or credential state; get the user's approval first) |\n| **Terraform (`hashicorp\u002Fgoogle`)** | Infrastructure only: `google_integrations_client` (region setup), `google_integrations_auth_config`, and `google_integration_connectors_*`. Does **not** manage integration workflow versions. | ADC or Terraform provider credentials |\n| **ADK (`ApplicationIntegrationToolset`)** | Exposes published API-trigger integrations or Integration Connectors actions\u002Fentities as tools for ADK agents (Python v0.1.0+, Java v0.3.0+). | ADC (`gcloud auth application-default login`) (changes host or credential state; get the user's approval first) or service account JSON |\n| **Cloud console** | Visual drag-and-drop editor, Quick\u002FAdvanced region setup, Approval task resolution, OAuth 2.0 authorization code consent flow. | Browser Google Cloud sign-in |\n\n- Use `gcloud` only for generic Google Cloud tasks: enabling APIs (`gcloud services enable`), printing access tokens (`gcloud auth print-access-token`), managing IAM, and reading Cloud Logging (`gcloud logging read`).\n- Integration Connectors includes an outbound **MCP connector** (`MCP v1` and `v2`) that lets a workflow call an external MCP server as a connector target; this is an outbound connector, not a Google-managed MCP server for controlling Application Integration.\n- Always use the global endpoint `https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002F...` consistently for REST calls.\n- **Note on draft testing (`integrations:test`)**: Although `POST ...\u002Fintegrations\u002FINTEGRATION_NAME:test` exists in the v1 REST API, its required `TestIntegrationsRequest.clientId` value is not publicly documented, so do not invent one; test integrations by publishing to a non-production project and calling `:execute`.\n- See [references\u002Fapi-access.md](references\u002Fapi-access.md) for authentication setup, `curl` commands, Python discovery client patterns, and ADK `ApplicationIntegrationToolset` configuration.\n\n## Step-by-Step Region Setup Workflow\n\nApplication Integration is regional: confirm the target region is supported on [Application Integration locations](https:\u002F\u002Fdocs.cloud.google.com\u002Fapplication-integration\u002Fdocs\u002Flocations.md.txt) and use `us-central1` as a well-supported default when the user has no preference. The region is the `LOCATION` in every REST path; no `gcloud` default-region setting applies to Application Integration. Provisioning is **per region**. Provisioning `us-central1` does not provision `europe-west1`; repeat region provisioning for every `LOCATION` you use in `PROJECT_ID`. Ensure an active billing account is attached to `PROJECT_ID` before setup—an active billing account is required even when usage stays within the monthly free tier (see the [Application Integration pricing page](https:\u002F\u002Fcloud.google.com\u002Fapplication-integration\u002Fpricing)).\n\n### 1. Check and enable required APIs\n\nFirst check which APIs are already enabled (read-only):\n\n```bash\ngcloud services list --enabled --project=PROJECT_ID \\\n  --filter=\"config.name:(integrations.googleapis.com OR connectors.googleapis.com OR secretmanager.googleapis.com OR cloudkms.googleapis.com)\"\n```\n\nAfter getting user confirmation, enable the required APIs (add `cloudkms.googleapis.com` only if configuring CMEK):\n\n```bash\ngcloud services enable \\\n  integrations.googleapis.com \\\n  connectors.googleapis.com \\\n  secretmanager.googleapis.com \\\n  --project=PROJECT_ID\n```\n\n### 2. Verify setup IAM roles on the caller\n\nSetting up Application Integration requires `roles\u002Fintegrations.integrationAdmin`, `roles\u002Fconnectors.admin`, and `roles\u002Feditor` (plus `roles\u002Fcloudkms.admin` for CMEK). Check current bindings (read-only):\n\n```bash\ngcloud projects get-iam-policy PROJECT_ID --format=json\n```\n\n### 3. Provision the region (`LOCATION`)\n\nChoose one of the three supported paths after getting user confirmation:\n\n- **Option A: REST (`clients:provision`)**\n  ```bash\n  curl -X POST \\\n    -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    -d '{}' \\\n    \"https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002Fclients:provision\"\n  ```\n  The response is `{}` when provisioning succeeds (`clients:provision` does not apply `runAsServiceAccount`; set the run-as identity on each integration version via `IntegrationVersion.runAsServiceAccount`). `{}` is also returned when the region is already provisioned; the call does not change an existing region's settings. Change HTTP calls or encryption on an existing region from the console's Regions page (when the region is already `ACTIVE`, `cloudKmsConfig`, `enableHttpCall`, and `enableManagedAiFeatures` on `clients:provision` are not applied). If `PROJECT_ID` was already registered through Apigee Integration, provisioning fails.\n\n- **Option B: Cloud console**\n  Open `https:\u002F\u002Fconsole.cloud.google.com\u002Fintegrations`, select `LOCATION`, and click **Quick setup** (enables the APIs, creates the default service account, and uses Google-managed encryption) or **Advanced setup** (to configure CMEK, HTTP calls, AI features, governance, or variable masking). To add another region later, go to **Regions > Provision new region**.\n\n- **Option C: Terraform (`google_integrations_client`)**\n  Use the `google_integrations_client` resource in `hashicorp\u002Fgoogle`. Do **not** set `run_as_service_account` on `google_integrations_client`—that argument was removed in provider v8.0.0 (August 26, 2026), and it mapped to the `clients:provision` `runAsServiceAccount` field, which is likewise not applied; set the run-as identity on each integration version (`IntegrationVersion.runAsServiceAccount`) instead.\n\n### 4. Sanity-check region access\n\nRun a read-only list call against the region; a successful `200 OK` response is a good sign that the API is reachable in `LOCATION`:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n  \"https:\u002F\u002Fintegrations.googleapis.com\u002Fv1\u002Fprojects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002Fintegrations\"\n```\n\nSee [references\u002Fprovisioning-and-terraform.md](references\u002Fprovisioning-and-terraform.md) for all `ProvisionClientRequest` fields, CMEK and governance options, and complete Terraform examples.\n\n## Core Concepts at a Glance\n\n- **Integrations and Triggers**: An integration is a workflow started by one or more triggers. Synchronous runs (`SYNC`) wait for completion and return output (`integrations.execute`, console test, sync `Call Integration`). Asynchronous runs (`ASYNC`) are fire-and-forget (`integrations.schedule`, Schedule, Cloud Scheduler, Cloud Pub\u002FSub, Salesforce triggers, and runs resumed after a suspension or approval).\n- **Tasks**: Units of work chained after a trigger (such as `Data Mapping`, `Call REST Endpoint`, `Connectors`, `JavaScript` on V8, `Cloud Function`, `Approval`, `Suspend`, `Timer`, loops, and `Call Integration`).\n- **Versions and Edit Locks**: Only a `DRAFT` version can be edited (locked to its author for 15 minutes after the last update). Only an `ACTIVE` (published) version runs from triggers. Publishing a version automatically unpublishes the prior active version and cancels any suspended executions of that prior version. Unpublishing moves an active version to `SNAPSHOT` (`PREVIOUSLY_PUBLISHED`). Calling `versions.delete` soft-deletes a version into `ARCHIVED` (listed as `DELETED` on the Integration versions documentation page).\n- **Variables**:\n  - **Integration variables**: Explicit inputs (`IN`), outputs (`OUT`), `IN_OUT`, or internal variables with `IN_OUT_TYPE_UNSPECIFIED` (`$varName$`).\n  - **Task variables**: Auto-generated task outputs named `` `Task_\u003CtaskId>_\u003CvariableName>` `` where `taskId` is the bare task number in `taskConfigs[].taskId` (for example, `taskId` `\"1\"` -> `` $`Task_1_responseBody`$ ``).\n  - **System variables**: keys are backtick-wrapped (`` `ExecutionId` ``, `` `ExecutionMode` ``, `` `ErrorInfo` `` [`message`, `code`], `` `IntegrationName` ``, `` `Region` ``, `` `ProjectId` ``); reference them as `` $`ExecutionId`$ `` (a bare `$ExecutionId$` names a nonexistent integration variable and fails).\n  - **Config variables** (Preview): Environment-specific values defined in `integrationConfigParameters` (with defaults in `parameter.defaultValue`; a top-level `value` on a draft is discarded) and supplied per environment in `configParameters` at publish time (named `` `CONFIG_\u003CNAME>` ``; keys in `configParameters` must **exactly match** a key in `integrationConfigParameters`, backticks included, such as `` \"`CONFIG_target_url`\" ``, because unknown keys are silently ignored—publish returns 200 and the default stays). **Never store secrets in config variables**—they are exported in plain text. Use an authentication profile (`authConfigs`) or the Secret Manager task instead.\n- **Suspensions**: `Suspend` tasks pause up to 31 days and are resumed via the Suspensions API (`suspensions:lift`, with an optional `suspensionResult`, requiring `integrations.suspensions.lift`). `Approval` tasks email approvers and can be approved or rejected in the Cloud console UI or via `suspensions:resolve` (`state`: `\"LIFTED\"` or `\"REJECTED\"`, requiring `integrations.suspensions.resolve`). Listing suspensions (`suspensions.list`) requires `integrations.suspensions.list`. All three permissions are included in `roles\u002Fintegrations.suspensionResolver` (and `roles\u002Fintegrations.integrationAdmin`), and resuming also requires `roles\u002Fiam.serviceAccountUser` on the integration's run-as service account; always confirm with the user before lifting or resolving. `Timer` tasks resume automatically.\n- **Authentication Profiles (`authConfigs`)**: Reusable regional credential records (`projects\u002FPROJECT_ID\u002Flocations\u002FLOCATION\u002FauthConfigs\u002FAUTH_CONFIG_ID`). They are not included when downloading an integration version.\n\nSee [references\u002Fcore-concepts.md](references\u002Fcore-concepts.md) for full details on version states, trigger types, task categories, variables, suspensions, and authentication profiles.\n\n## IAM and the Run-As Service Account Requirement\n\n### Key IAM roles and service agents\n\n- **Developer & operator roles**: `roles\u002Fintegrations.integrationAdmin` (full CRUD + delete auth profiles), `roles\u002Fintegrations.integrationEditor` (create\u002Fupload\u002Fedit\u002Ftest\u002Finvoke\u002Fcancel\u002Freplay\u002Fpublish, including `integrations.integrationVersions.create` and `integrations.integrationVersions.deploy`), `roles\u002Fintegrations.integrationDeployer` (publish\u002Funpublish via `integrations.integrationVersions.deploy`; holds `list`\u002F`get`\u002F`deploy` but not `create`, so it can publish an existing version but cannot upload), `roles\u002Fintegrations.integrationInvoker` (invoke\u002Fcancel\u002Freplay), `roles\u002Fintegrations.integrationViewer` (view integrations and logs), and `roles\u002Fintegrations.suspensionResolver` (list, lift, and resolve suspensions: `integrations.suspensions.list`, `integrations.suspensions.lift`, `integrations.suspensions.resolve`; `suspensionResolver` alone cannot read execution records, so also grant `roles\u002Fintegrations.integrationViewer` to inspect `taskExecutionDetails` or run `:troubleshoot`, or use the approval email link, which carries the execution and task IDs).\n- **Service agents**:\n  - **Application Integration service agent**: `service-PROJECT_NUMBER@gcp-sa-integrations.iam.gserviceaccount.com` (granted `roles\u002Fintegrations.serviceAgent`).\n  - **Integration Connectors service agent**: `service-PROJECT_NUMBER@gcp-sa-connectors.iam.gserviceaccount.com` (granted `roles\u002Fconnectors.serviceAgent`).\n\n### Mandatory run-as service account rules (effective October 15, 2026)\n\n1. **Explicit identity required**: For integrations created on or after October 15, 2026 (and for existing integrations at a later date), every run needs an explicit identity—either the triggering caller or a user-managed run-as service account set per integration version via `IntegrationVersion.runAsServiceAccount` (region provisioning via `clients:provision` does not apply `runAsServiceAccount`).\n2. **Triggers other than API or Private require a run-as service account**: Integrations created on or after October 15, 2026 with any trigger other than an API or Private trigger (for example Schedule, Cloud Scheduler, Cloud Pub\u002FSub, Eventarc, Salesforce, or Connector Event) **cannot be tested or published unless `runAsServiceAccount` is set**. Private triggers are exempt like API triggers, so a sub-integration whose only trigger is Private can be published without `runAsServiceAccount`.\n3. **Region governance**: If governance is enabled on the region, a run-as service account is mandatory for **every** new integration and version, including API-trigger integrations.\n4. **Service Account User (`roles\u002Fiam.serviceAccountUser`)**: Whenever `runAsServiceAccount` is set on a version, the user (or principal) publishing or testing the version must hold `roles\u002Fiam.serviceAccountUser` on that service account (or its owning project). At runtime, the invoking caller or trigger service account—and anyone resolving or lifting a suspension—must also hold `roles\u002Fiam.serviceAccountUser` on it.\n5. **Best practice**: Create one dedicated, minimally scoped user-managed service account per integration. When `runAsServiceAccount` is set and no task-level auth profile is set, it mints tokens for Connector, Call REST Endpoint, and Cloud Function tasks (an OAuth 2.0 or OIDC auth profile on a task takes precedence over `runAsServiceAccount`).\n\nSee [references\u002Fiam-and-service-accounts.md](references\u002Fiam-and-service-accounts.md) for the complete IAM role tables, service agent permissions, credential precedence rules, and `gcloud` IAM commands.\n\n## Key Quotas and Limits to Design Around\n\n| Limit | Value | Design impact |\n| :--- | :--- | :--- |\n| **SYNC execution timeout** | 2 minutes | Use async triggers or `integrations.schedule` for workflows exceeding 2 minutes; timed-out sync runs become `CANCELLED`. |\n| **ASYNC execution timeout** | 10 minutes | Split heavy work into sub-integrations or external jobs if a single async run exceeds 10 minutes. |\n| **Max execution lifetime** | 31 days | Includes time paused in `Approval` or `Suspend` tasks (max 44,640 minutes). |\n| **Total integration data** | 30 MB | Shared across input\u002Foutput variables and private-trigger sub-integrations. **Above 10 MB, local logging is disabled**, retries stop working, and monitoring skips the run. |\n| **API trigger input size** | 8 MB | Cumulative size across all input variables; larger payloads fail before the workflow starts. |\n| **Connectors data & timeout** | 8 MB in\u002Fout; 3 min timeout | Application Integration quotas cap cumulative data sent to\u002Ffrom connections at 8 MB and connector response at 20 MB (Integration Connectors quotas cap the Connectors task payload at 10 MB); custom queries cap at 180 seconds and 50,000 rows. |\n| **Concurrent executions** | 50 per project per region; 10 per integration (defaults) | Both concurrency caps are adjustable; a burst on a single integration hits the 10-per-integration cap, not 50. The execution request rate quota is shown on the project's Cloud Quotas page and can be adjusted there. |\n| **Integrations \u002F tasks \u002F versions** | 1,000 \u002F 100 \u002F 100 | Up to 1,000 integrations per project, 100 tasks per integration, and 100 versions per integration. |\n| **Publish propagation** | Up to 10 minutes | Eventual consistency: an older version can keep running for up to 10 minutes after publishing a new version. |\n\nSee [references\u002Flimits.md](references\u002Flimits.md) for all task-specific payload caps, loop iteration limits, Integration Connectors node limits, and pricing details.\n\n## Sibling Skills\n\n- **application-integration-basics** (this skill): Concepts, API enablement, region provisioning, IAM roles and run-as service accounts, interface choices (REST, Python client, Terraform, ADK), and quotas\u002Flimits.\n- **application-integration-authoring**: Building, uploading, versioning, config variables, publishing, executing, and testing integrations via the REST API; trigger IDs; task gotchas; and CI\u002FCD promotion across projects with download\u002Fupload.\n- **application-integration-troubleshooting**: Diagnosing failed or stuck executions, checking execution and task states and `ErrorInfo`, listing and filtering executions, Cloud Logging and Cloud Monitoring, suspensions and approvals, Integration Connectors connection health, and IAM \u002F run-as \u002F quota errors.\n\n## Reference Files\n\n- [references\u002Fattribution.md](references\u002Fattribution.md): Usage attribution for `gcloud` CLI commands, direct `curl` REST calls, and Python discovery-client snippets run in the terminal.\n- [references\u002Fcore-concepts.md](references\u002Fcore-concepts.md): Triggers, execution modes, task types, version lifecycle, edit locks, variables, suspensions, and authentication profiles.\n- [references\u002Fiam-and-service-accounts.md](references\u002Fiam-and-service-accounts.md): Predefined IAM roles for Application Integration and Integration Connectors, service agents, run-as service account rules, and IAM commands.\n- [references\u002Fprovisioning-and-terraform.md](references\u002Fprovisioning-and-terraform.md): Per-region provisioning via REST `clients:provision`, Cloud console Quick\u002FAdvanced setup, CMEK caveats, and Terraform `google_integrations_*` \u002F `google_integration_connectors_*` resources.\n- [references\u002Fapi-access.md](references\u002Fapi-access.md): Endpoints, authentication, `curl` examples, Python `google-api-python-client` discovery patterns, ADK `ApplicationIntegrationToolset`, and MCP connector clarification.\n- [references\u002Flimits.md](references\u002Flimits.md): Timeouts, payload caps, concurrency quotas, loop\u002Ftask limits, Integration Connectors limits, and pricing tiers.\n",{"name":5,"metadata":49,"description":7},{"version":50,"category":51},"1.0.2","ApplicationDevelopment","main","bb9b3f464aae37af360d079c1d863524955b0363","skills\u002Fcloud\u002Fapplication-integration-basics",2002,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-13 02:42:47",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add google\u002Fskills --skill application-integration-basics",{"tool":67,"command":68},"bunx","bunx skills add google\u002Fskills --skill application-integration-basics",{"tool":70,"command":71},"pnpm","pnpm dlx skills add google\u002Fskills --skill application-integration-basics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002FSKILL.md",true,[75,81,85,89,93,97],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-access.md","REFERENCE","参考文档",11800,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002Freferences\u002Fapi-access.md",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fattribution.md",5079,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002Freferences\u002Fattribution.md",{"path":86,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fcore-concepts.md",14082,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002Freferences\u002Fcore-concepts.md",{"path":90,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fiam-and-service-accounts.md",15161,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002Freferences\u002Fiam-and-service-accounts.md",{"path":94,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Flimits.md",6414,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002Freferences\u002Flimits.md",{"path":98,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fprovisioning-and-terraform.md",8467,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fapplication-integration-basics\u002Freferences\u002Fprovisioning-and-terraform.md",[102,135,165,194,221,244],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":114,"publishedAt":44},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[108,111],{"categoryNo":109,"categoryName":110,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[9,115,116,117,118,119,120,121,122,41,123,124,43,125,126,37,127,128,129,130,131,132,133,134],"sign in with google web","sign","with","web","android","go","security","google workspace","implement","policy","implementing","react","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":150,"publishedAt":44},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[141,142,145],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[151,152,9,41,153,154,155,156,157,39,37,158,159,160,161,162,163,131,134,164,29],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","browser","loops","at","node","token","pair","platform",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":177,"publishedAt":44},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[171,172,175,176],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":173,"categoryName":174,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},[178,179,180,181,41,182,183,184,185,186,187,188,189,29,190,191,192,37,193,127],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":44},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[201,202,203,204,205,206,207,208,43,209,210,211,212,213,214,187,215,216,217,29,218,219,192,220],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":230,"publishedAt":44},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[227,228,229],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},[9,231,232,33,233,164,234,235,236,237,238,155,239,28,240,188,241,242,29,243,191],"finding google skills","storage","messaging","model","trade-offs","provider","answer","fit","catalog","decision","use","database","candidate",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":252,"publishedAt":44},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[250,251],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},[253,254,130,27,9,181,255,41,182,256,257,258,259,29,260,191,37,261,262,263,40],"workload manager basics","workload","cli","review","vpc","resources","inspect","you","create","libraries","server"]