SOPs
Google Business Profile API
Access
Section titled “Access”API access approved 2026-04-16 (ticket 3-6942000041257), after a same-day denial on 2-3114000041055 (see The two applications).
Public-facing writeup: I Got Into the Google Business Profile API.
What the API unlocks
Section titled “What the API unlocks”The Google Business Profile API is the programmatic door to the same listing a human manages through the dashboard. Four use cases drive the need for first-party access over third-party schedulers like GHL Social Planner:
- Close the review loop — programmatic reply to new reviews, routed through the same system that handles customer messages.
- Own the posting pipeline — push Local Posts from my own content engine instead of paying for or trusting a middleware scheduler.
- Pull performance data into dashboards — calls, direction requests, search impressions, photo views — alongside GSC and GA data, not inside Google’s UI.
- Update business info in bulk — hours, categories, attributes, services — without clicking through each profile.
The two applications
Section titled “The two applications”Two tickets got filed under ojhurst@gmail.com, about two minutes apart.
| Ticket | Outcome | Reason |
|---|---|---|
2-3114000041055 | Denied | ”A requestor’s email should be an owner/manager of a listing that has been verified for 60+ days.” The email on that application was attached to a listing that had been verified for less than 60 days. |
3-6942000041257 | Approved | Same day, different requestor email attached to an older verified listing. |
The 60-day rule is the single biggest gotcha. It is not about the profile being 60+ days old — it is about the email’s role on that profile being 60+ days old. If I add a new manager today, that manager cannot apply for API access for another two months.
Which GCP project owns it
Section titled “Which GCP project owns it”TODO: confirm and paste the exact GCP project id once I check the Developer Console.
Once confirmed, the API shows up under APIs & Services → Library → Google Business Profile API inside that project. Enable it there before the credentials will work.
Scopes
Section titled “Scopes”Required OAuth scope for full functionality:
https://www.googleapis.com/auth/business.manageThis is a single broad scope that covers read and write across every endpoint in the Business Profile API family (locations, posts, media, reviews, insights, attributes, verifications, Q&A). There are no per-feature sub-scopes the way Gmail splits read vs modify.
Endpoint families
Section titled “Endpoint families”| Endpoint family | Base path | Read | Write |
|---|---|---|---|
| Accounts | /v1/accounts | List accounts I have access to | — |
| Locations | /v1/accounts/{id}/locations | List, get | Create, update, delete |
| Local Posts | /v4/accounts/{id}/locations/{id}/localPosts | List, get | Create, update, delete |
| Media (photos + videos) | /v4/accounts/{id}/locations/{id}/media | List, get | Upload |
| Reviews | /v4/accounts/{id}/locations/{id}/reviews | List, get | Reply, delete reply |
| Q&A | /v1/locations/{id}/questions | List | Upvote, answer |
| Service items | /v1/locations/{id} (servicesItems field) | Read via location | Update via location PATCH |
| Insights | /v1/locations/{id}:fetchMultiDailyMetricsTimeSeries | Daily metrics time series | — |
| Verifications | /v1/locations/{id}/verifications | List | Start, complete |
| Attributes | /v1/attributes | List attribute definitions | Update via location PATCH |
Media notes: photos up to 5MB (JPG, PNG), videos up to 75MB and 30 seconds (MP4). Uploads are two-phase — start upload, then PUT bytes to the returned URL.
Rate limits and quotas
Section titled “Rate limits and quotas”- Default project quota: ~1 query/second sustained, bursts up to a few per second.
- Insights endpoints have stricter per-day quotas than read endpoints.
- Writes (especially Posts and review replies) are throttled harder than reads. If I am going to push bulk posts, batch them with backoff.
- Google does not publish exact numbers in advance. Watch the Cloud Console quota page under the project once the API is enabled.
What lives where
Section titled “What lives where”- GCP project: TODO confirm.
- OAuth client: create a new Desktop client under the project’s Credentials page. Download the client JSON.
- Token storage:
~/apps/gbp-api/token.json(proposed — repo does not exist yet; create when I actually wire this up). - Authorize script: will follow the same pattern as
~/apps/gmail-helper/authorize.py— local loopback on port 8099, save refreshed token, refresh on every call. - CLI:
~/apps/gbp-api/gbp.py(proposed) with subcommands mirroring gmail-helper:locations,reviews,posts,insights.
Use cases I am building toward
Section titled “Use cases I am building toward”- Review replies through Claude Code + CRM. New review arrives → webhook or polled pull → Claude drafts reply in the approval queue → approved replies posted via
reviews.reply→ logged to the CRM conversation history. - Cross-post to GBP from the content engine. Same pipeline that posts to Facebook and LinkedIn gets a GBP node. Images served from the VPS, CTA buttons mapped to the right profile.
- GBP insights in the daily digest. ATH daily digest and Go Kart Park dashboard pull calls, direction requests, search impressions, and photo views alongside the CRM and Cloudflare numbers already in there.
- Bulk business info updates. When hours change for a holiday, a category is added, or a service item is launched, one script updates every relevant location at once.
How to apply for another business
Section titled “How to apply for another business”When I want API access for a second business (different GCP project, different owner email):
- Verify eligibility first. The applicant email must be an owner or manager on the target listing for at least 60 days. Check the People tab on the profile.
- Create a new GCP project. Do not reuse the approved one — each business gets its own to keep quotas and credentials separate.
- Enable the Business Profile API in the new project’s API Library.
- Create an OAuth client under the new project.
- File the application at the Business Profile API support page. Be specific: what you are building, how many locations, whether it is first-party only or a tool others will use.
- Wait for the approval email. If denied, the email will name the rule that failed. Fix and reapply.
Related
Section titled “Related”- Public blog post: I Got Into the Google Business Profile API
- Connections entry: Connections
- Google docs entry point: Google Business Profile APIs overview
- Auth pattern this will follow: Gmail Search and Triage (same OAuth-token-on-disk approach)