--- title: "POST /v1/{+parent}/toolsets" method: POST path: "/v1/{+parent}/toolsets" tags: ["projects"] --- # POST /v1/{+parent}/toolsets `POST /v1/{+parent}/toolsets` Creates a new toolset in the given app. ## Path parameters - `parent` string, required ## Query parameters - `toolsetId` string ## Request body - Toolset — A toolset represents a group of dynamically managed tools that can be used by the agent. - `etag` string — ETag used to ensure the object hasn't changed during a read-modify-write operation. If the etag is empty, the update will overwrite any concurrent changes. - `mcpToolset` McpToolset — A toolset that contains a list of tools that are offered by the MCP server. - `serviceDirectoryConfig` ServiceDirectoryConfig — Configuration for tools using Service Directory. - `service` string — Required. The name of [Service Directory](https://cloud.google.com/service-directory) service. Format: `projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}`. Location of the service directory must be the same as the location of the app. - `toolOverrides` McpToolOverride[] — Optional. Overrides for individual tools within this toolset. This allows overriding specific details like descriptions, names, or pinning the tools' states so they aren't fully dynamic. - `tool` string — Required. The original name of the tool as it is emitted by the MCP server. - `snapshot` McpToolDefinition — Container for a tool's core definition elements that are snapshot. Schemas in the snapshot are used as-is and cannot be overridden. - `outputSchema` Schema — Represents a select subset of an OpenAPI 3.0 schema object. - `items` Schema — recursive - `maximum` number, double — Optional. Maximum value for Type.INTEGER and Type.NUMBER. - `prefixItems` Schema[] — Optional. Schemas of initial elements of Type.ARRAY. - `minimum` number, double — Optional. Minimum value for Type.INTEGER and Type.NUMBER. - `required` string[] — Optional. Required properties of Type.OBJECT. - `enum` string[] — Optional. Possible values of the element of primitive type with enum format. Examples: 1. We can define direction as : {type:STRING, format:enum, enum:["EAST", NORTH", "SOUTH", "WEST"]} 2. We can define apartment number as : {type:INTEGER, format:enum, enum:["101", "201", "301"]} - `title` string — Optional. The title of the schema. - `properties` object — Optional. Properties of Type.OBJECT. - `default` unknown - `uniqueItems` boolean — Optional. Indicate the items in the array must be unique. Only applies to TYPE.ARRAY. - `ref` string — Optional. Allows indirect references between schema nodes. The value should be a valid reference to a child of the root `defs`. For example, the following schema defines a reference to a schema node named "Pet": ``` type: object properties: pet: ref: #/defs/Pet defs: Pet: type: object properties: name: type: string ``` The value of the "pet" property is a reference to the schema node named "Pet". See details in https://json-schema.org/understanding-json-schema/structuring. - `maxItems` string, int64 — Optional. Maximum number of the elements for Type.ARRAY. - `anyOf` Schema[] — Optional. The value should be validated against any (one or more) of the subschemas in the list. - `description` string — Optional. The description of the data. - `defs` object — Optional. A map of definitions for use by `ref`. Only allowed at the root of the schema. - `type` 'TYPE_UNSPECIFIED' | 'STRING' | 'INTEGER' | 'NUMBER' | 'BOOLEAN' | 'OBJECT' | 'ARRAY' — Required. The type of the data. - `additionalProperties` Schema — recursive - `nullable` boolean — Optional. Indicates if the value may be null. - `minItems` string, int64 — Optional. Minimum number of the elements for Type.ARRAY. - `description` string — Output only. The description of the MCP tool. This can be overridden by `description_override` in `McpToolOverride`. - `inputSchema` Schema — Represents a select subset of an OpenAPI 3.0 schema object. - `items` Schema — recursive - `maximum` number, double — Optional. Maximum value for Type.INTEGER and Type.NUMBER. - `prefixItems` Schema[] — Optional. Schemas of initial elements of Type.ARRAY. - `minimum` number, double — Optional. Minimum value for Type.INTEGER and Type.NUMBER. - `required` string[] — Optional. Required properties of Type.OBJECT. - `enum` string[] — Optional. Possible values of the element of primitive type with enum format. Examples: 1. We can define direction as : {type:STRING, format:enum, enum:["EAST", NORTH", "SOUTH", "WEST"]} 2. We can define apartment number as : {type:INTEGER, format:enum, enum:["101", "201", "301"]} - `title` string — Optional. The title of the schema. - `properties` object — Optional. Properties of Type.OBJECT. - `default` unknown - `uniqueItems` boolean — Optional. Indicate the items in the array must be unique. Only applies to TYPE.ARRAY. - `ref` string — Optional. Allows indirect references between schema nodes. The value should be a valid reference to a child of the root `defs`. For example, the following schema defines a reference to a schema node named "Pet": ``` type: object properties: pet: ref: #/defs/Pet defs: Pet: type: object properties: name: type: string ``` The value of the "pet" property is a reference to the schema node named "Pet". See details in https://json-schema.org/understanding-json-schema/structuring. - `maxItems` string, int64 — Optional. Maximum number of the elements for Type.ARRAY. - `anyOf` Schema[] — Optional. The value should be validated against any (one or more) of the subschemas in the list. - `description` string — Optional. The description of the data. - `defs` object — Optional. A map of definitions for use by `ref`. Only allowed at the root of the schema. - `type` 'TYPE_UNSPECIFIED' | 'STRING' | 'INTEGER' | 'NUMBER' | 'BOOLEAN' | 'OBJECT' | 'ARRAY' — Required. The type of the data. - `additionalProperties` Schema — recursive - `nullable` boolean — Optional. Indicates if the value may be null. - `minItems` string, int64 — Optional. Minimum number of the elements for Type.ARRAY. - `nameOverride` string — Optional. If present, this tool uses this name in the Agent instead of the original name. This is primarily used as an alias if the MCP server offers poorly named tools. - `descriptionOverride` string — Optional. If present, this tool uses this description instead of the original description from the server. - `apiAuthentication` ApiAuthentication — Authentication information required for API calls. - `oauthConfig` OAuthConfig — Configurations for authentication with OAuth. - `clientId` string — Required. The client ID from the OAuth provider. - `clientSecretVersion` string — Required. The name of the SecretManager secret version resource storing the client secret. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-@gcp-sa-ces.iam.gserviceaccount.com`. - `oauthGrantType` 'OAUTH_GRANT_TYPE_UNSPECIFIED' | 'CLIENT_CREDENTIAL' — Required. OAuth grant types. - `scopes` string[] — Optional. The OAuth scopes to grant. - `tokenEndpoint` string — Required. The token endpoint in the OAuth provider to exchange for an access token. - `serviceAccountAuthConfig` ServiceAccountAuthConfig — Configurations for authentication using a custom service account. - `serviceAccount` string — Required. The email address of the service account used for authentication. CES uses this service account to exchange an access token and the access token is then sent in the `Authorization` header of the request. The service account must have the `roles/iam.serviceAccountTokenCreator` role granted to the CES service agent `service-@gcp-sa-ces.iam.gserviceaccount.com`. - `scopes` string[] — Optional. The OAuth scopes to grant. If not specified, the default scope `https://www.googleapis.com/auth/cloud-platform` is used. - `apiKeyConfig` ApiKeyConfig — Configurations for authentication with API key. - `keyName` string — Required. The parameter name or the header name of the API key. E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name. - `requestLocation` 'REQUEST_LOCATION_UNSPECIFIED' | 'HEADER' | 'QUERY_STRING' — Required. Key location in the request. - `apiKeySecretVersion` string — Required. The name of the SecretManager secret version resource storing the API key. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-@gcp-sa-ces.iam.gserviceaccount.com`. - `serviceAgentIdTokenAuthConfig` ServiceAgentIdTokenAuthConfig — Configurations for authentication with [ID token](https://cloud.google.com/docs/authentication/token-types#id) generated from service agent. - `bearerTokenConfig` BearerTokenConfig — Configurations for authentication with a bearer token. - `token` string — Required. The bearer token. Must be in the format `$context.variables.`. - `serverAddress` string — Required. The address of the MCP server, for example, "https://example.com/mcp/". If the server is built with the MCP SDK, the url should be suffixed with "/mcp/". Only Streamable HTTP transport based servers are supported. See https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http for more details. - `tlsConfig` TlsConfig — The TLS configuration. - `caCerts` TlsConfigCaCert[] — Required. Specifies a list of allowed custom CA certificates for HTTPS verification. - `displayName` string — Required. The name of the allowed custom CA certificates. This can be used to disambiguate the custom CA certificates. - `cert` string, byte — Required. The allowed custom CA certificates (in DER format) for HTTPS verification. This overrides the default SSL trust store. If this is empty or unspecified, CES will use Google's default trust store to verify certificates. N.B. Make sure the HTTPS server certificates are signed with "subject alt name". For instance a certificate can be self-signed using the following command: ``` openssl x509 -req -days 200 -in example.com.csr \ -signkey example.com.key \ -out example.com.crt \ -extfile <(printf "\nsubjectAltName='DNS:www.example.com'") ``` - `customHeaders` object — Optional. The custom headers to send in the request to the MCP server. The values must be in the format `$context.variables.` and can be set in the session variables. See https://docs.cloud.google.com/customer-engagement-ai/conversational-agents/ps/tool/open-api#openapi-injection for more details. - `timeout` string, google-duration — Optional. The timeout for the toolset execution. If not set, the default timeout is 30 seconds for `SYNCHRONOUS` toolsets and 60 seconds for `ASYNCHRONOUS` toolsets. - `displayName` string — Optional. The display name of the toolset. Must be unique within the same app. - `name` string — Identifier. The unique identifier of the toolset. Format: `projects/{project}/locations/{location}/apps/{app}/toolsets/{toolset}` - `toolFakeConfig` ToolFakeConfig — Configuration for tool behavior in fake mode. - `codeBlock` CodeBlock — A code block to be executed instead of a real tool call. - `pythonCode` string — Required. Python code which will be invoked in tool fake mode. Expected Python function signature - To catch all tool calls: def fake_tool_call(tool: Tool, input: dict[str, Any], callback_context: CallbackContext) -> Optional[dict[str, Any]]: To catch a specific tool call: def fake_{tool_id}(tool: Tool, input: dict[str, Any], callback_context: CallbackContext) -> Optional[dict[str, Any]]: If the function returns None, the real tool will be invoked instead. - `enableFakeMode` boolean — Optional. Whether the tool is using fake mode. - `updateTime` string, google-datetime — Output only. Timestamp when the toolset was last updated. - `connectorToolset` ConnectorToolset — A toolset that generates tools from an Integration Connectors Connection. - `connection` string — Required. The full resource name of the referenced Integration Connectors Connection. Format: `projects/{project}/locations/{location}/connections/{connection}` - `connectorActions` Action[] — Required. The list of connector actions/entity operations to generate tools for. - `connectionActionId` string — ID of a Connection action for the tool to use. - `inputFields` string[] — Optional. Entity fields to use as inputs for the operation. If no fields are specified, all fields of the Entity will be used. - `entityOperation` ActionEntityOperation — Entity CRUD operation specification. - `entityId` string — Required. ID of the entity. - `operation` 'OPERATION_TYPE_UNSPECIFIED' | 'LIST' | 'GET' | 'CREATE' | 'UPDATE' | 'DELETE' — Required. Operation to perform on the entity. - `outputFields` string[] — Optional. Entity fields to return from the operation. If no fields are specified, all fields of the Entity will be returned. - `authConfig` EndUserAuthConfig — End-user authentication configuration used for Connection calls. The field values must be the names of context variables in the format `$context.variables.`. - `oauth2AuthCodeConfig` EndUserAuthConfigOauth2AuthCodeConfig — Oauth 2.0 Authorization Code authentication configuration. - `oauthToken` string — Required. Oauth token parameter name to pass through. Must be in the format `$context.variables.`. - `oauth2JwtBearerConfig` EndUserAuthConfigOauth2JwtBearerConfig — JWT Profile Oauth 2.0 Authorization Grant authentication configuration. - `subject` string — Required. Subject parameter name to pass through. Must be in the format `$context.variables.`. - `clientKey` string — Required. Client parameter name to pass through. Must be in the format `$context.variables.`. - `issuer` string — Required. Issuer parameter name to pass through. Must be in the format `$context.variables.`. - `createTime` string, google-datetime — Output only. Timestamp when the toolset was created. - `executionType` 'EXECUTION_TYPE_UNSPECIFIED' | 'SYNCHRONOUS' | 'ASYNCHRONOUS' — Optional. The execution type of the tools in the toolset. - `openApiToolset` OpenApiToolset — A toolset that contains a list of tools that are defined by an OpenAPI schema. - `openApiSchema` string — Required. The OpenAPI schema of the toolset. - `tlsConfig` TlsConfig — The TLS configuration. - `caCerts` TlsConfigCaCert[] — Required. Specifies a list of allowed custom CA certificates for HTTPS verification. - `displayName` string — Required. The name of the allowed custom CA certificates. This can be used to disambiguate the custom CA certificates. - `cert` string, byte — Required. The allowed custom CA certificates (in DER format) for HTTPS verification. This overrides the default SSL trust store. If this is empty or unspecified, CES will use Google's default trust store to verify certificates. N.B. Make sure the HTTPS server certificates are signed with "subject alt name". For instance a certificate can be self-signed using the following command: ``` openssl x509 -req -days 200 -in example.com.csr \ -signkey example.com.key \ -out example.com.crt \ -extfile <(printf "\nsubjectAltName='DNS:www.example.com'") ``` - `apiAuthentication` ApiAuthentication — Authentication information required for API calls. - `oauthConfig` OAuthConfig — Configurations for authentication with OAuth. - `clientId` string — Required. The client ID from the OAuth provider. - `clientSecretVersion` string — Required. The name of the SecretManager secret version resource storing the client secret. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-@gcp-sa-ces.iam.gserviceaccount.com`. - `oauthGrantType` 'OAUTH_GRANT_TYPE_UNSPECIFIED' | 'CLIENT_CREDENTIAL' — Required. OAuth grant types. - `scopes` string[] — Optional. The OAuth scopes to grant. - `tokenEndpoint` string — Required. The token endpoint in the OAuth provider to exchange for an access token. - `serviceAccountAuthConfig` ServiceAccountAuthConfig — Configurations for authentication using a custom service account. - `serviceAccount` string — Required. The email address of the service account used for authentication. CES uses this service account to exchange an access token and the access token is then sent in the `Authorization` header of the request. The service account must have the `roles/iam.serviceAccountTokenCreator` role granted to the CES service agent `service-@gcp-sa-ces.iam.gserviceaccount.com`. - `scopes` string[] — Optional. The OAuth scopes to grant. If not specified, the default scope `https://www.googleapis.com/auth/cloud-platform` is used. - `apiKeyConfig` ApiKeyConfig — Configurations for authentication with API key. - `keyName` string — Required. The parameter name or the header name of the API key. E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name. - `requestLocation` 'REQUEST_LOCATION_UNSPECIFIED' | 'HEADER' | 'QUERY_STRING' — Required. Key location in the request. - `apiKeySecretVersion` string — Required. The name of the SecretManager secret version resource storing the API key. Format: `projects/{project}/secrets/{secret}/versions/{version}` Note: You should grant `roles/secretmanager.secretAccessor` role to the CES service agent `service-@gcp-sa-ces.iam.gserviceaccount.com`. - `serviceAgentIdTokenAuthConfig` ServiceAgentIdTokenAuthConfig — Configurations for authentication with [ID token](https://cloud.google.com/docs/authentication/token-types#id) generated from service agent. - `bearerTokenConfig` BearerTokenConfig — Configurations for authentication with a bearer token. - `token` string — Required. The bearer token. Must be in the format `$context.variables.`. - `serviceDirectoryConfig` ServiceDirectoryConfig — Configuration for tools using Service Directory. - `service` string — Required. The name of [Service Directory](https://cloud.google.com/service-directory) service. Format: `projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}`. Location of the service directory must be the same as the location of the app. - `ignoreUnknownFields` boolean — Optional. If true, the agent will ignore unknown fields in the API response for all operations defined in the OpenAPI schema. - `url` string — Optional. The server URL of the Open API schema. This field is only set in toolsets in the environment dependencies during the export process if the schema contains a server url. During the import process, if this url is present in the environment dependencies and the schema has the $env_var placeholder, it will replace the placeholder in the schema. - `description` string — Optional. The description of the toolset. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/ces.md) · [All operations](https://skmtc.net/google/apis/ces/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/ces/versions/429598666166/schema)