Everything an AI agent can do with the Google Analytics API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints33
API versionv1
Last updated23 June 2026
Orientation

How the Google Analytics API works.

The Google Analytics API is how an app or AI agent works with a Google Analytics 4 property: running a report over event data, pulling realtime activity, reading account and property configuration, and creating or editing data streams and custom fields. Access is granted through an OAuth 2.0 token and the scopes it carries, where a read-only scope covers reports and configuration reads and an edit scope is needed to change configuration, and an agent reaches only the properties its identity can see. There is no event push, so an app reads by calling the API when it needs data.

33Endpoints
9Capability groups
20Read
13Write
2Permissions
Authentication
Google Analytics authenticates with OAuth 2.0. A call carries a Bearer access token, obtained either through the user authorization-code flow on behalf of a signed-in person, or through a service account for server-side automation. The token reaches only the accounts and properties the underlying identity has been granted in Google Analytics, and a request names the target in its resource path, like properties/{propertyId}.
Permissions
Access is governed by OAuth scopes. The analytics.readonly scope (https://www.googleapis.com/auth/analytics.readonly) covers running reports and reading configuration across both the Data and Admin APIs. The analytics.edit scope (https://www.googleapis.com/auth/analytics.edit) is required for Admin API writes, like creating a property or editing a data stream. Two further scopes, analytics.manage.users and analytics.manage.users.readonly, govern managing and viewing user access. A scope that is too narrow returns 403 PERMISSION_DENIED.
Versioning
Each API is versioned by a path segment. The Data API and Admin API both run on the stable v1beta track, and a v1alpha track carries newer features first, like funnel reports and recurring audience lists, at alpha stability while feedback is gathered. New methods and dimensions ship through the Data API changelog without breaking the v1beta surface.
Data model
Google Analytics is split into two APIs over an account-and-property hierarchy. The Data API runs reports over the event data of a property, named properties/{propertyId}, returning rows of dimensions and metrics. The Admin API manages the configuration around that data: accounts, properties, data streams, custom dimensions and metrics, plus access and change-history reports. There is no event push; an app reads by calling the API.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Google Analytics determines what it can reach. There is an API for pulling report data, an API for managing the account and property configuration, and a first-party server that exposes Google Analytics to agents, and each is governed by an OAuth token and the permissions it carries.

Ways to connect

Data API

The Data API answers at analyticsdata.googleapis.com and runs reports over a property's event data, including standard, pivot, batched, and realtime reports, plus metadata and compatibility checks. A request authenticates with an OAuth 2.0 token and names the property in the path.

Best forPulling Google Analytics report data into an app or AI agent.
Governed byThe OAuth token and the scope it carries.
Docs ↗

Admin API

The Admin API answers at analyticsadmin.googleapis.com and reads and changes account, property, data-stream, and custom-field configuration, plus access and change-history reports. A request authenticates with an OAuth 2.0 token whose scope decides whether it can read or edit configuration.

Best forManaging Google Analytics configuration from an app or AI agent.
Governed byThe OAuth token and the scope it carries.
Docs ↗

MCP server (Model Context Protocol)

Google's official Google Analytics MCP server lets an agent query Analytics through the Model Context Protocol. It runs locally from the package google-analytics-mcp, wraps the Data API and read parts of the Admin API, and is read-only, so it cannot change configuration. The source is at github.com/googleanalytics/google-analytics-mcp.

Best forConnecting an AI agent to Google Analytics through MCP.
Governed byThe OAuth credentials the server runs with.
Docs ↗
Authentication

OAuth 2.0 (user)

A standard OAuth 2.0 authorization-code flow grants an access token on behalf of a Google user. The token is limited to the scopes the user consents to, and reaches only the accounts and properties that user can see in Google Analytics.

TokenOAuth access token (Bearer)
Best forActing on behalf of a signed-in Google Analytics user.
Docs ↗

Service account

A service account is a non-human Google identity that authenticates with its own key and is granted access to specific Google Analytics properties. It is the usual choice for server-side automation that runs without a person present, and it reaches only the properties it has been added to.

TokenService-account-signed JWT exchanged for an access token
Best forServer-side automation with no user present.
Docs ↗
Capability map

What an AI agent can do in Google Analytics.

Google Analytics splits into two APIs an agent can act on. The Data API runs reports over event data, and the Admin API reads and changes the account, property, and data-stream configuration. Reading reports and configuration needs only read permission, while changing configuration or user access needs more.

Reporting (Data API)

4 endpoints

Run reports over Google Analytics event data, including standard, pivot, and batched reports.

These reads return real visitor and event data for the property.
View endpoints

Realtime (Data API)

1 endpoint

Run a report over event data from the last 30 minutes.

These reads return live visitor activity for the property.
View endpoints

Metadata & compatibility (Data API)

2 endpoints

List the dimensions and metrics available for a property and check which combine in one report.

Read-only inspection of what a property can report on.
View endpoints

Audience exports (Data API)

4 endpoints

Create, list, read, and query exports of the users in an audience.

A write here creates an export that materializes the users in an audience.
View endpoints

Accounts (Admin API)

5 endpoints

List, read, update, and delete Google Analytics accounts and read account summaries.

A write here changes or removes a real Google Analytics account.
View endpoints

Properties (Admin API)

5 endpoints

List, read, create, update, and delete the properties inside an account.

A write here changes or removes a real property.
View endpoints

Data streams (Admin API)

5 endpoints

List, read, create, update, and delete the web and app data streams that feed a property.

A write here changes how data is collected into a property.
View endpoints

Custom dimensions & metrics (Admin API)

5 endpoints

List, read, create, update, and archive a property's custom dimensions and custom metrics.

A write here changes the custom fields available for reporting.
View endpoints

Access & change history (Admin API)

2 endpoints

Run an access report on who viewed the data and search the change history of configuration edits.

These reads expose who accessed data and what was changed.
View endpoints
Endpoint reference

Every Google Analytics API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Reporting (Data API)

Run reports over Google Analytics event data, including standard, pivot, and batched reports.4

Core reporting method; charges core quota tokens by request complexity. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onreport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens, charged by complexity

Pivots dimensions into a cross-tab; charges core quota tokens. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onreport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens, charged by complexity

Each report in the batch charges core quota tokens. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onreport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens, charged by complexity

Each pivot report in the batch charges core quota tokens. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onreport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens, charged by complexity

Realtime (Data API)

Run a report over event data from the last 30 minutes.1

Charges from a separate realtime token budget, not the core budget. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onrealtime report
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRealtime tokens, charged by complexity

Metadata & compatibility (Data API)

List the dimensions and metrics available for a property and check which combine in one report.2

Used to validate a report before running it. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts oncompatibility
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens

Includes custom dimensions, custom metrics, and saved comparisons for the property. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onmetadata
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens

Audience exports (Data API)

Create, list, read, and query exports of the users in an audience.4

Creates a long-running export job; readonly scope is sufficient because it reads users into an export. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaudienceExport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens

Reports whether the export has finished and is ready to query. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaudienceExport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaudienceExport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the user-level rows captured when the export was created. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaudienceExport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCore tokens

Accounts (Admin API)

List, read, update, and delete Google Analytics accounts and read account summaries.5

A lightweight way to discover accessible accounts and their properties. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaccountSummary
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaccount
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaccount
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Editing configuration needs the edit scope. Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts onaccount
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Marks the account for deletion; it can be restored within the trash retention window. Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts onaccount
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Properties (Admin API)

List, read, create, update, and delete the properties inside an account.5

Takes a required filter naming the parent account. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onproperty
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onproperty
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts onproperty
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts onproperty
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Marks the property for deletion; it can be restored within the trash retention window. Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts onproperty
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Data streams (Admin API)

List, read, create, update, and delete the web and app data streams that feed a property.5

A data stream is a web or app source of data into the property. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts ondataStream
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts ondataStream
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts ondataStream
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts ondataStream
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Stops collection from that source into the property. Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts ondataStream
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Custom dimensions & metrics (Admin API)

List, read, create, update, and archive a property's custom dimensions and custom metrics.5

Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts oncustomDimension
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts oncustomDimension
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Custom dimensions are archived rather than deleted. Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts oncustomDimension
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts oncustomMetric
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Custom metrics are archived rather than deleted. Full OAuth scope: https://www.googleapis.com/auth/analytics.edit.

Acts oncustomMetric
Permission (capability)analytics.edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Access & change history (Admin API)

Run an access report on who viewed the data and search the change history of configuration edits.2

Returns the data-access audit records for the property or account. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onaccessReport
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns who changed what configuration and when. Full OAuth scope: https://www.googleapis.com/auth/analytics.readonly.

Acts onchangeHistoryEvent
Permission (capability)analytics.readonly
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Google Analytics does not push events to a webhook. An app or AI agent reads report data and configuration by calling the API when it needs them, rather than receiving notifications when something changes.

EventWhat it signalsTriggered by
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Google Analytics limits how much an app or AI agent can call the Data API through a token budget spent per property and per project each hour and day, alongside caps on how many report requests run at once.

Request rate

The Data API meters reporting by a token budget, not a flat request count. Each request spends tokens by its complexity, driven by the number of dimensions and metrics, filter complexity, date-range length, and data cardinality, so a request for more than six months of data can spend 1,000 or more tokens. A standard property gets 200,000 core tokens per day and 40,000 per hour, with 14,000 per hour scoped to a single project, plus a separate realtime token budget on the same scale; Analytics 360 properties get ten times those limits. On top of the budgets, a standard property allows 10 concurrent core requests and 50 on Analytics 360, caps server errors per project per property per hour, and allows 120 potentially thresholded requests per hour. Going over returns HTTP 429 RESOURCE_EXHAUSTED, and a request can set returnPropertyQuota to true to read remaining quota in the response.

Pagination

Data API report rows are paged with the limit and offset fields in the request, where limit sets the page size up to 250,000 rows and offset starts the next page; the rowCount field in the response says how many rows match in total. Admin API list methods are paged with pageSize and pageToken, returning a nextPageToken until the last page.

Request size

A single Data API report request returns at most 250,000 rows per page, with 100,000 the default when no limit is set, and a report can request up to 9 dimensions and 10 metrics. An audience export and the user-level data it returns are read in pages through the same limit and offset fields.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400INVALID_ARGUMENTThe request is malformed, such as an unknown dimension or metric, an invalid date range, or an incompatible combination of fields in a report.Fix the named field and resend; checkCompatibility helps validate a report before running it. The request is not retryable as-is.
401UNAUTHENTICATEDAuthentication is missing, invalid, or expired, so the OAuth token was not accepted.Refresh or reissue the OAuth token and resend it in the Authorization header.
403PERMISSION_DENIEDThe token is valid but lacks access, either because the scope is too narrow for the call or because the identity has no role on the account or property.Grant the needed scope, such as the edit scope for a configuration change, or add the identity to the property in Google Analytics.
404NOT_FOUNDThe named account, property, or resource does not exist or is not visible to the caller.Confirm the resource name in the path is correct and that the identity has access to it.
429RESOURCE_EXHAUSTEDA quota was exhausted, such as the core or realtime token budget for a property or project, the concurrent-request cap, or the thresholded-request cap.Back off and retry with exponential backoff; set returnPropertyQuota to true on Data API reports to read remaining quota, and reduce request complexity or date range to spend fewer tokens.
500INTERNALAn unexpected error on Google's side. It is rare and can also surface as 503 UNAVAILABLE.Retry idempotently with exponential backoff, and report it if it persists.
Versioning & freshness

Version history.

Google Analytics versions each API by a path segment, with the Data API and Admin API both at v1beta and a v1alpha track that carries newer features like funnel reports first.

Version history

What changed, and when

Latest versionv1
v1Current version
Data API and Admin API on v1beta (current stable)

The Data API and Admin API run on the stable v1beta track, versioned by a path segment, with a v1alpha track that carries newer features first. New methods, dimensions, and metrics ship through the changelog without breaking the v1beta surface. This entry tracks the current v1 generation of the Google Analytics 4 APIs.

What changed
  • April 2026: conversion performance reporting added to runReport, with a new ConversionSpec field for filtering conversions.
  • October 2024: EmptyFilter dimension filter added, for matching blank values.
  • September 2024: getPropertyQuotasSnapshot added, returning current property quotas by category.
  • May 2024: asynchronous reportTasks methods added for long-running reports, and key-event dimensions and metrics replaced the deprecated conversion fields.
2024-03
Channel-group and platform dimensions (March 2024)

The Data API schema expanded with new reporting dimensions.

What changed
  • Added primary channel group and manual traffic-source dimensions.
  • Added integration-specific dimensions for Campaign Manager 360, Display & Video 360, and Search Ads 360.
2023-12
Audience Exports moved to v1beta (December 2023)

The Audience Lists feature graduated from the alpha track to the stable Data API v1beta as Audience Exports.

What changed
  • Added audienceExports create, get, list, and query methods to v1beta.
  • An audience export snapshots the users in an audience at creation time for retrieval.
2023-05
Quota limits increased (May 2023)

Token quotas were raised across the categories of the Data API.

What changed
  • Increased core, realtime, and funnel token budgets for standard and Analytics 360 properties.
  • Later rebalanced so simple queries cost less while long date-range reports cost significantly more tokens.

An integration can build on the stable v1beta track and adopt v1alpha features once they graduate.

Google Analytics Data API changelog ↗
Questions

Google Analytics API, answered.

What's the difference between the Data API and the Admin API?+
The Data API runs reports over a property's event data, returning rows of dimensions and metrics for standard, pivot, batched, and realtime reports. The Admin API reads and changes the configuration around that data, like accounts, properties, data streams, and custom dimensions and metrics. A reporting agent usually needs only the Data API and the analytics.readonly scope; changing configuration needs the Admin API and the analytics.edit scope.
Which OAuth scope does an agent need?+
Running reports and reading configuration need analytics.readonly (https://www.googleapis.com/auth/analytics.readonly), which covers most read-only agents across both APIs. Changing configuration through the Admin API, such as creating a property or editing a data stream, needs analytics.edit (https://www.googleapis.com/auth/analytics.edit). Managing who can access an account uses analytics.manage.users, or analytics.manage.users.readonly to only view those permissions. A token whose scope is too narrow returns 403 PERMISSION_DENIED.
How do the Data API quotas work?+
The Data API charges a token budget rather than counting requests flatly. Each report spends tokens by complexity, so a wider report over a longer date range costs more, and a request beyond six months of data can spend 1,000 or more tokens. A standard property gets 200,000 core tokens a day and 40,000 an hour, with a separate realtime budget; Analytics 360 gets ten times those limits. Setting returnPropertyQuota to true returns the remaining quota in the response, and exhausting it returns 429 RESOURCE_EXHAUSTED.
Does Google Analytics send webhooks?+
No. Google Analytics has no event-push or webhook model in these APIs. An app or AI agent reads report data and configuration by calling the Data API or Admin API when it needs them, rather than receiving a notification when data or settings change. Frequent polling spends quota, so a schedule that matches how often the data is actually used is more efficient.
Is there an official Google Analytics MCP server?+
Yes. Google publishes an official Google Analytics MCP server, installed locally from the google-analytics-mcp package, with source at github.com/googleanalytics/google-analytics-mcp. It lets an agent query Analytics through the Model Context Protocol, wrapping the Data API and read parts of the Admin API. It is read-only, so it cannot change configuration or settings.
How are reports paginated, and how many rows can one return?+
Data API reports page with the limit and offset fields in the request, where limit tops out at 250,000 rows per page and defaults to 100,000 when unset, and the response rowCount field gives the total matching rows. A report can request up to 9 dimensions and 10 metrics. Admin API list methods page instead with pageSize and pageToken, following nextPageToken until it is absent.
Related

More analytics API guides for agents

What is Bollard AI?

Control what every AI agent can do in Google Analytics.

Bollard AI sits between a team's AI agents and Google Analytics. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Google Analytics token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Google Analytics
Reporting Agent
Run reports ActionOffReadFull use
Read property settings ResourceOffReadFull use
Edit data streams ResourceOffReadFull use
Manage user access ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Google Analytics