I was trying to list all agents from the discoveryengine v1alpha REST endpoint. But I encountered a permission issue.
I am using a service account, when I assign it the Gemini Enterprise Editor (Beta) or Discovery Engine Editor IAM role, I can list agents successfully. However, when I change it to the Gemini Enterprise Viewer (Beta) or Discovery Engine Viewer, I receive the following error:
{
"error": {
"code": 403,
"message": "User does not have permission to list all of the agents.",
"status": "PERMISSION_DENIED"
}
}
The documentation states the following:
IAM Permissions
Requires the following IAM permission on the parent resource:
discoveryengine.agents.list
Since the Gemini Enterprise Viewer (Beta) already includes the permission discoveryengine.agents.list, I don’t know why it isn’t working.
I also tried cloning the Gemini Enterprise Editor (beta) into a custom role. The process automatically removed resourcemanager.projects.list, and I still could not list the agents. I then combined the custom role with Browser role which has the resourcemanager.projects.list permission, but it still failed.
Any idea on how to use a Viewer role to list agents?