AVAILABLE

Developer Tools

Cloud Resource ID Guard

Parse, build, compare, batch-check, and apply explicit policy to AWS ARNs, Azure resource IDs, and Google Cloud full resource names without contacting a provider.

Get an API key on RapidAPIOpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST
POST /v1/cloud-resources/policy-check
MCP tool
check_cloud_resource_identifier_policy
Inputs
One bounded AWS ARN, Azure Resource Manager resource ID, or Google Cloud full resource name, plus optional provider, service, account, subscription, project, scope, and wildcard policy.
Returns
CLEAR, REVIEW_REQUIRED, or BLOCKED with a canonical identifier, provider-aware components, scope evidence, named findings, and an agent-readable next action.
Latency
Synchronous
Usage unit
Cloud identifier operation

The focused suite also exposes /v1/cloud-resources/inspect, /v1/cloud-resources/build, /v1/cloud-resources/compare, and /v1/cloud-resources/batch/inspect plus the separate /mcp/cloud server. It never contacts AWS, Azure, Google Cloud, DNS, or another network service; verifies no resource existence or authorization; performs no action; and stores no payload. A CLEAR result is static identifier evidence only.

AGENT-READABLE EXCEPTIONS

CLOUD_IDENTIFIER_INVALIDCLOUD_IDENTIFIER_WILDCARDCLOUD_PROVIDER_NOT_ALLOWEDCLOUD_SERVICE_DENIEDCLOUD_SERVICE_NOT_ALLOWEDCLOUD_SCOPE_DENIEDCLOUD_SCOPE_NOT_ALLOWEDCLOUD_SCOPE_REQUIREDCLOUD_WILDCARD_BLOCKED
HTTP request
POST /v1/cloud-resources/policy-check
Authorization: Bearer apc_...
Content-Type: application/json

{
  "identifier": "//run.googleapis.com/projects/ap-prod/locations/us-central1/services/invoice-api",
  "allowed_providers": [
    "GCP"
  ],
  "allowed_services": [
    "gcp:run.googleapis.com"
  ],
  "allowed_gcp_projects": [
    "ap-prod"
  ]
}
cURL (bash)
curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/cloud-resources/policy-check' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "identifier": "//run.googleapis.com/projects/ap-prod/locations/us-central1/services/invoice-api",
  "allowed_providers": [
    "GCP"
  ],
  "allowed_services": [
    "gcp:run.googleapis.com"
  ],
  "allowed_gcp_projects": [
    "ap-prod"
  ]
}'
Representative response
{
  "status": "COMPLETED",
  "decision": "CLEAR",
  "permitted": true,
  "parsed": {
    "provider": "GCP",
    "normalized": "//run.googleapis.com/projects/ap-prod/locations/us-central1/services/invoice-api",
    "scope": {
      "project_id": "ap-prod",
      "location": "us-central1"
    },
    "service": "run.googleapis.com",
    "resource_type": "services",
    "resource_name": "invoice-api",
    "contains_wildcard": false,
    "static_analysis_only": true,
    "resource_existence_verified": false,
    "authorization_checked": false,
    "network_access_performed": false,
    "payload_stored": false
  },
  "findings": [],
  "ruleset_version": "2026-08-10",
  "static_analysis_only": true,
  "authorization_checked": false,
  "resource_existence_verified": false,
  "network_access_performed": false,
  "payload_stored": false,
  "next_action": "Continue only with provider-native authorization, existence, action, and policy checks."
}
Three provider formatsAWS ARNs, Azure Resource Manager IDs, and Google Cloud full resource names return one consistent, provider-aware result.
No provider or network callThe API parses supplied identifiers only; it verifies no resource existence, permission, live policy, or requested action.
Authorization still requiredA CLEAR identifier must still pass provider-native authorization, existence, action, and policy checks before use.

Use Cloud Resource ID Guard through RapidAPI.

Choose a capped marketplace plan, copy the generated request, and route the structured result through your own authorized workflow.

Get an API key on RapidAPICompare marketplace controls →