Home Docs Claude Developer Platform 27 Oct 2026

One change · api

claude-models-on-google-cloud-anthropic-managed-iam-permissions changedapi/claude-models-on-google-cloud-anthropic-managed-iam-permissions

Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 27 Oct 2026 18:58 UTC

Lines+10added

Lines−10removed

From line 4 where the diff opens

First seen 23 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

The whole hunk

from line 4, old and new numbered

lines

from line 4

44description: Look up Google Cloud IAM permissions, predefined roles, and audit log types for Claude Models on Google Cloud (Anthropic managed).

55---

7Claude Models on Google Cloud (Anthropic managed) uses Google Cloud IAM for access control. Every API route needs one permission from the `claude.googleapis.com` service. If the caller doesn't hold that permission, Google Cloud returns an HTTP 403 error. Three predefined roles bundle the permissions. For setup and authentication, see [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed).

7Claude Models on Google Cloud (Anthropic managed) uses Google Cloud IAM for access control. Every API route needs one permission from the `claude.googleapis.com` service. If the caller doesn’t hold that permission, Google Cloud returns an HTTP 403 error. Three predefined roles bundle the permissions. For setup and authentication, see [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed).

99## Service details

1010

from line 38

3838

3939The `get` and `list` permissions are the read-only ones.

4040

41Unless a section says otherwise, each route's audit log type is Data Access.

41Unless a section says otherwise, each route’s audit log type is Data Access.

4242

43`roles/claude.viewer` can't send messages or count tokens. Sending a message needs `messages.create`. Counting tokens needs `messages.countTokens`.

43`roles/claude.viewer` can’t send messages or count tokens. Sending a message needs `messages.create`. Counting tokens needs `messages.countTokens`.

4444

4545Some routes in the following tables might not be available to your organization. To check which features are available, see [Feature support](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#feature-support).

4646

from line 61

6161| `messageBatches.delete` | Admin, User | `DELETE /v1/messages/batches/{message_batch_id}` |

6262| `messageBatches.cancel` | Admin, User | `POST /v1/messages/batches/{message_batch_id}/cancel` |

6363

64`roles/claude.viewer` can read batch results. `messageBatches.get` authorizes both reading a batch's metadata and downloading its results.

64`roles/claude.viewer` can read batch results. `messageBatches.get` authorizes both reading a batch’s metadata and downloading its results.

6565

6666### Models

6767

from line 79

7979| `files.list` | Admin, User, Viewer | `GET /v1/files` |

8080| `files.delete` | Admin, User | `DELETE /v1/files/{file_id}` |

8181

82`roles/claude.viewer` can download files. `files.get` authorizes both reading a file's metadata and downloading its content.

82`roles/claude.viewer` can download files. `files.get` authorizes both reading a file’s metadata and downloading its content.

8383

8484### Skills

8585

from line 116

116116| `sessions.archive` | Admin, User | `POST /v1/sessions/{session_id}/archive`<br />`POST /v1/sessions/{session_id}/threads/{thread_id}/archive` |

117117| `sessions.delete` | Admin, User | `DELETE /v1/sessions/{session_id}` |

118118

119`sessions.get` authorizes reading the session, its event history and event stream, its resources, and its threads. As a result, `roles/claude.viewer` can read every session's full event history.

119`sessions.get` authorizes reading the session, its event history and event stream, its resources, and its threads. As a result, `roles/claude.viewer` can read every session’s full event history.

120120

121121Other session operations need the following permissions:

122122

from line 146

146146

147147This permission is separate from `environments.update`. Reading the work queue and its statistics needs only `environments.get`.

148148

149Besides `environments.processWork`, a worker needs other permissions to run a session, such as `sessions.get` to read the session and its events, `sessions.update` to send tool results, and `skills.get` to download the agent's skills.

150150

151151### Vaults

152152

from line 169

169169* Reading a credential: `vaults.get`

170170* Checking a stored MCP OAuth credential: `vaults.verify`

171171

172With `vaults.get`, `roles/claude.viewer` can list a vault's credentials. Claude Models on Google Cloud (Anthropic managed) never returns a credential's secret fields. To learn more, see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults).

172With `vaults.get`, `roles/claude.viewer` can list a vault’s credentials. Claude Models on Google Cloud (Anthropic managed) never returns a credential’s secret fields. To learn more, see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults).

173173

174174### Memory stores

175175

from line 227

227227| `externalKeys.update` | Admin | `POST /v1/organizations/external_keys/{external_key_id}` |

228228| `externalKeys.delete` | Admin | `DELETE /v1/organizations/external_keys/{external_key_id}` |

229229

230These permissions manage your organization's encryption key registrations. Of the three predefined roles, only `roles/claude.admin` includes them.

230These permissions manage your organization’s encryption key registrations. Of the three predefined roles, only `roles/claude.admin` includes them.

231231

232232### Usage reports

233233