stuntstunt
← all adapters

google-iam-style

simulates Google Cloud IAM API + Service Accounts v1

restadapter v0.1.010 routes

verification

SDKverified with google-api-go-client v0.293.0· surface 10 · not implemented 4 · differs 2

use it

# add to stunt.yaml
services:
  google-iam:
    adapter: embedded:google-iam-style

# then
$ stunt up

The embedded: source extracts this adapter from the binary — no git clone, fully offline.

how to mock the Google Cloud IAM API + Service Accounts API locally

Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of Google Cloud IAM API + Service Accounts. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real Google Cloud IAM API + Service Accounts v1 surface — the data is fake, the behavior is real.

backing stores

tokensservice_accountssa_keys

api surface (10)

generated from the adapter manifest — exactly what boots, nothing more · covers 10% of the real API's 133 routes (derived from sdk google-api-go-client @ v0.293.0)

10 routes
POST/oauth2/v4/token
GET/oauth2/v3/certs
GET/v1/projects/{project}/serviceAccounts
POST/v1/projects/{project}/serviceAccounts
GET/v1/projects/{project}/serviceAccounts/{sa}
DELETE/v1/projects/{project}/serviceAccounts/{sa}
GET/v1/projects/{project}/serviceAccounts/{sa}/keys
POST/v1/projects/{project}/serviceAccounts/{sa_verb}
POST/v1/roles:queryGrantableRoles
POST/v1/projects/{project}/roles:queryGrantableRoles

SDK-verified behaviors (7)

  • ✓jwt-bearer exchange mints the SDK's access token
  • ✓ServiceAccounts.List returns the seeded account
  • ✓ServiceAccounts.Create + Get round-trip
  • ✓ServiceAccounts.Keys.List returns managed keys
  • ✓Roles.QueryGrantableRoles returns grantable roles
  • ✓ServiceAccounts.Delete then Get -> googleapi 404
  • ✓Garbage bearer -> googleapi 401

Not implemented (4)

  • No serviceAccountKeys create/delete, signJwt, or signBlob methods
  • No serviceAccount patch, disable/enable, undelete, or getIamPolicy
  • No generateIdToken method
  • No roles list, get, create, or custom-role CRUD endpoints

Differs from the real API (2)

  • JWKS serves one fixed synthetic RSA-2048 key (kid mock-google-key-1)
  • roles:queryGrantableRoles also served project-scoped (extra form; the real path is project-less)
full scorecard →
want more of the Google Cloud IAM API + Service Accounts surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.