Google SAS Portal API
Browse all Google APIs40
AI ReadinessFoundational (D-)40/100
Official vendor OpenAPI document · agent-readyIOTDevice Managementoauth224 EndpointsREST
For Agents
Manage CBRS Spectrum Access System deployments - list customers, provision deployments, run installer validation, and update SAS access policies programmatically.
Use for: List all SAS customers visible to the calling principal, Provision a new SAS deployment under a customer, Migrate a legacy SAS organization onto the current customer schema, Generate an installer secret for a CBRS device installer
Not supported: Does not transmit radio signals, register individual CBRS devices on the air, or perform spectrum allocation calculations - use for SAS Portal administration of customers, deployments, installers, and policies only.
The Google SAS Portal API administers Spectrum Access System deployments for the CBRS 3.5 GHz radio band, the framework that Google uses to coordinate shared wireless spectrum in the United States. It exposes endpoints to manage customers, deployments, GCP project bindings, legacy organization migration, installer secret generation and validation, and access policies. The portal is used by SAS administrators and CBRS device installers to configure how customer devices are registered with Google's SAS service.
Install Jentic One Beta
Connect the SAS Portal API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the SAS Portal API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fsasportal" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fsasportal" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with SAS Portal API.
List SAS customers and the legacy organizations associated with them
Provision a SAS deployment under a customer and bind it to a GCP project
Migrate a legacy SAS organization onto the current customer model
Generate and validate installer secrets used by certified professional installers
Set, get, and test access policies that gate operations on SAS resources
Set up SAS analytics for a customer to enable spectrum usage reporting
Use Cases
Patterns agents use SAS Portal API for, with concrete tasks.
★ CBRS deployment provisioning
A neutral-host operator onboards a new enterprise customer onto its CBRS network. An automation agent calls the SAS Portal to provision a deployment under the customer record, binds it to the customer's GCP project, and configures access policies so the customer's installers can register devices. This replaces a multi-step console workflow.
POST /v1alpha1/customers:provisionDeployment for the new customer, then POST /v1alpha1/policies:set with the installer principal and the relevant role.
Installer secret generation for field technicians
Certified Professional Installers register CBRS devices in the field. A back-office agent generates installer secrets through the SAS Portal API, sends them securely to field technicians, and validates them on incoming registration requests. The generateSecret and validate endpoints provide both halves of this flow.
POST /v1alpha1/installer:generateSecret for each technician, distribute the secret out-of-band, then POST /v1alpha1/installer:validate during device registration.
Legacy organization migration
Operators carrying SAS deployments from the legacy organization model migrate to the current customer model so they can take advantage of newer access controls and analytics. An agent enumerates legacy organizations and calls migrateOrganization on each, recording the resulting customer IDs for downstream reference.
GET /v1alpha1/customers:listLegacyOrganizations, then POST /v1alpha1/customers:migrateOrganization on each entry.
Agent-driven CBRS administration through Jentic
An AI agent built on Jentic exposes SAS Portal administration as tools for the operations team: list customers, provision deployments, generate installer secrets. It searches Jentic for the right operation by intent and runs it. OAuth credentials remain isolated in your Jentic One instance throughout.
Search Jentic for 'provision sas deployment', execute POST /v1alpha1/customers:provisionDeployment, return the new deployment ID.
Key Endpoints
24 endpoints — the google sas portal api administers spectrum access system deployments for the cbrs 3.
METHOD
PATH
DESCRIPTION
GET
/v1alpha1/customers
List SAS customers
POST
/v1alpha1/customers:provisionDeployment
Provision a new SAS deployment
POST
/v1alpha1/customers:migrateOrganization
Migrate a legacy SAS organization
GET
/v1alpha1/customers:listLegacyOrganizations
List legacy SAS organizations
POST
/v1alpha1/installer:generateSecret
Generate an installer secret
POST
/v1alpha1/installer:validate
Validate an installer secret
POST
/v1alpha1/policies:set
Set an access policy on a SAS resource
POST
/v1alpha1/policies:get
Get the access policy on a SAS resource
GET
/v1alpha1/customers
List SAS customers
POST
/v1alpha1/customers:provisionDeployment
Provision a new SAS deployment
POST
/v1alpha1/customers:migrateOrganization
Migrate a legacy SAS organization
GET
/v1alpha1/customers:listLegacyOrganizations
List legacy SAS organizations
POST
/v1alpha1/installer:generateSecret
Generate an installer secret
POST
/v1alpha1/installer:validate
Validate an installer secret
POST
/v1alpha1/policies:set
Set an access policy on a SAS resource
POST
/v1alpha1/policies:get
Get the access policy on a SAS resource
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
S
SAS Portal API
- Foundational (D-)40/100
57
Foundational Compliance56
Developer Experience & Jentic Compatibility18
AI-Readiness & Agent Experience94
Agent Usability63
Security57
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
57
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: CSignals: 4
77%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
50%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
56
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: CSignals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
25%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
18
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
74%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
0%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
63
Security
Trust, risk posture, and security compliance.
Grade: B-Signals: 1
62%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
57
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: CSignals: 1
57%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the SAS Portal API by hand means configuring Google OAuth 2.0, minting scoped access tokens, and threading customer, deployment, and installer resource names through the v1alpha1 endpoints on sasportal.googleapis.com. Through Jentic you install once, import the SAS Portal API from the API Directory, store the OAuth credential once, and your agent calls it.
Permission scoping
This API carries the customer and deployment identifiers in the URL path, so a rule can pin your agent to one customer: it can list and provision within that scope and nothing else. You choose the operations it may call, so state-changing ones like migrating an organization or setting a policy are not included unless you add them.
Credential isolation
Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and a scoped access token is injected at execution time. The credential never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'provision a SAS deployment' or 'generate an installer secret', and Jentic returns the matching SAS Portal operation with its input schema so the agent calls the right endpoint without browsing the v1alpha1 docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using SAS Portal API through Jentic.
What authentication does the SAS Portal API use?
It uses Google OAuth 2.0 with the cloud-platform and sasportal scopes, declared as Oauth2 and Oauth2c. SAS Portal access is restricted to authorized SAS administrators and certified professional installer principals. Through Jentic, OAuth tokens are held encrypted in the vault and exchanged at call time.
Can I provision a SAS deployment with the API?
Yes. POST /v1alpha1/customers:provisionDeployment creates a new SAS deployment under the calling customer and returns the deployment record. The deployment can then be bound to a GCP project and have its access policies configured before installers register devices against it.
What are the rate limits for the SAS Portal API?
Google applies per-project quotas to SAS Portal calls; the dominant constraints are on installer secret generation and validation, which are rate-limited to prevent abuse during field registration. Read calls have a per-minute quota that scales with demonstrated usage and can be raised through the Cloud Console.
How do I generate an installer secret through Jentic?
Search Jentic for 'generate sas installer secret', load the schema for POST /v1alpha1/installer:generateSecret, and execute. Jentic returns the generated secret value, which the agent can then deliver to the field technician through an internal channel; the secret is short-lived by design.
Is the SAS Portal API free?
The API itself is free to call within Google Cloud quotas, but SAS service usage and per-device registration may carry separate charges under the operator's CBRS commercial agreement with Google. The API does not bill per call.
How do I migrate a legacy SAS organization?
Call GET /v1alpha1/customers:listLegacyOrganizations to enumerate eligible legacy records, then POST /v1alpha1/customers:migrateOrganization with the legacy organization identifier. The response contains the new customer record on the current schema, which inherits the legacy organization's deployments.
Can I limit what my agent is allowed to do with the SAS Portal API?
Yes. Because you run Jentic One yourself, your own rules decide which SAS Portal operations and credentials the agent may use. Since customer and deployment identifiers travel in the URL path, you can pin the agent to a single customer so it only lists customers and provisions deployments within that scope. State-changing calls like POST /v1alpha1/customers:migrateOrganization or POST /v1alpha1/policies:set are excluded unless you explicitly grant them.
GET STARTED