The Google Workspace Events API lets you subscribe to events and manage change notifications across Google Workspace applications.

API hub lets you consolidate and organize information about all of the APIs of interest to your organization. API hub lets you capture critical information about APIs that allows developers to discover and evaluate them easily and leverage the work of other teams wherever possible. API platform teams can use API hub to have visibility into and manage their portfolio of APIs.

google-cloud-app_hub is the official client library for the App Hub API.

google-cloud-backupdr is the official client library for the Backup and DR Service API.

The Google Cloud Security Operations API, popularly known as the Chronicle API, serves endpoints that enable security analysts to analyze and mitigate a security threat throughout its lifecycle.

Provides insights about your customers and their Assured Workloads based on your Sovereign Controls by Partners offering.

Enables users to create and manage connections to Google Cloud services and third-party business applications using the Connectors interface.

Developer Connect streamlines integration with third-party source code management platforms by simplifying authentication, authorization, and networking configuration.

The Cloud API for device streaming usage.

google-cloud-edge_container is the official client library for the Distributed Cloud Edge Container API.

google-cloud-financial_services is the official client library for the Financial Services API.

google-cloud-gdc_hardware_management is the official client library for the GDC Hardware Management API.

google-cloud-lustre is the official client library for the Google Cloud Managed Lustre API.

Manage Apache Kafka clusters and resources.

google-cloud-memorystore is the official client library for the Memorystore API.

google-cloud-network_services is the official client library for the Network Services API.

The Oracle Database@Google Cloud API provides a set of APIs to manage Oracle database services, such as Exadata and Autonomous Databases.

google-cloud-parallelstore is the official client library for the Parallelstore API.

Parameter Manager is a single source of truth to store, access and manage the lifecycle of your workload parameters. Parameter Manager aims to make management of sensitive application parameters effortless for customers without diminishing focus on security.

## Overview Privileged Access Manager (PAM) is a Google Cloud native, managed solution to secure, manage and audit privileged access while ensuring operational velocity and developer productivity. PAM enables just-in-time, time-bound, approval-based access elevations, and auditing of privileged access elevations and activity. PAM lets you define the rules of who can request access, what they can request access to, and if they should be granted access with or without approvals based on the sensitivity of the access and emergency of the situation. ## Concepts ### Entitlement An entitlement is an eligibility or license that allows specified users (requesters) to request and obtain access to specified resources subject to a set of conditions such as duration, etc. entitlements can be granted to both human and non-human principals. ### Grant A grant is an instance of active usage against the entitlement. A user can place a request for a grant against an entitlement. The request may be forwarded to an approver for their decision. Once approved, the grant is activated, ultimately giving the user access (roles/permissions) on a resource per the criteria specified in entitlement. ### How does PAM work PAM creates and uses a service agent (Google-managed service account) to perform the required IAM policy changes for granting access at a specific resource/access scope. The service agent requires getIAMPolicy and setIAMPolicy permissions at the appropriate (or higher) access scope - Organization/Folder/Project to make policy changes on the resources listed in PAM entitlements. When enabling PAM for a resource scope, the user/ principal performing that action should have the appropriate permissions at that resource scope (resourcemanager.{projects|folders|organizations}.setIamPolicy, resourcemanager.{projects|folders|organizations}.getIamPolicy, and resourcemanager.{projects|folders|organizations}.get) to list and grant the service agent/account the required access to perform IAM policy changes.