ETAG_MISMATCH

The etag sent does not match the Resource's current etag.

Checked 2026-09-28

The etag sent does not match the Resource's current etag.

HTTP 409 · gRPC ABORTED · the error body

#Returned by

Method	Scope	What it does
`access.orgs.update`	`access:admin`	Updates an org.
`access.orgs.delete`	`access:admin`	Deletes an org and everything in it. Deletion cascades through every service, so it returns an Operation.
`access.projects.update`	`access:admin`	Updates a project.
`access.projects.delete`	`access:admin`	Deletes a project.
`access.envs.update`	`access:admin`	Updates an environment.
`access.envs.delete`	`access:admin`	Deletes an environment.
`access.service_enablements.update`	`access:admin`	Enables or disables a service on a project (`spec.enabled`).
`access.api_keys.update`	`access:keys:write`	Updates an API key.
`access.api_keys.delete`	`access:keys:write`	Deletes an API key.
`access.api_keys.revoke`	`access:keys:write`	Revokes an API key immediately; revocation propagates on its own fast path, ahead of the bulk key data.
`access.api_keys.roll`	`access:keys:write`	Rolls an API key: returns a new key with the same spec and revokes the old one after the grace period.
`agents.agents.update`	`agents:write`	Updates an agent. A change to `spec` mints the next AgentVersion; sessions already started keep the version they pinned.
`agents.agents.delete`	`agents:write`	Deletes an agent and its versions. An agent with sessions is refused with `INVALID_STATE` unless `force` is set, which deletes them too.
`agents.agent_sessions.delete`	`agents:sessions`	Deletes a session and its events. A session whose turn is running is refused with `INVALID_STATE` unless `force` is set, which interrupts it first.
`agents.memory_stores.update`	`agents:write`	Updates a memory store.
`agents.memory_stores.delete`	`agents:write`	Deletes a memory store. A store an agent names is refused with `RESOURCE_IN_USE`; a store with memories is refused with `INVALID_STATE` unless `force` is set, which deletes them too.
`agents.memories.update`	`agents:write`	Changes a memory's content.
`agents.memories.delete`	`agents:sessions`	Deletes a memory. An end user may delete their own.
`artifacts.artifacts.delete`	`artifacts:write`	Deletes an artifact; fails while a Release references it or a legal hold is active.
`auth.auth_configs.update`	`auth:write`	Updates an auth config.
`auth.end_users.update`	`auth:write`	Updates an end user.
`auth.end_users.delete`	`auth:write`	Deletes an end user.
`auth.end_users.suspend`	`auth:write`	Suspends an end user: sessions are revoked and sign-in is refused.
`auth.end_users.reactivate`	`auth:write`	Reactivates a suspended end user.
`auth.customer_organizations.update`	`auth:write`	Updates a customer organization.
`auth.customer_organizations.delete`	`auth:write`	Deletes a customer organization.
`auth.memberships.update`	`auth:write`	Updates a membership.
`auth.memberships.delete`	`auth:write`	Deletes a membership.
`auth.organization_roles.update`	`auth:write`	Updates an organization role.
`auth.organization_roles.delete`	`auth:write`	Deletes an organization role.
`auth.email_domains.delete`	`auth:write`	Deletes an email domain.
`auth.oauth_clients.update`	`auth:write`	Updates an OAuth client.
`auth.oauth_clients.delete`	`auth:write`	Deletes an OAuth client.
`auth.oauth_clients.roll_secret`	`auth:write`	Issues a new client secret, returned once; the old one verifies until `grace_period` ends.
`billing.billing_accounts.update`	`billing:admin`	Updates a billing account: changes plan, spend limit, or billing email.
`broker.trust_policies.update`	`broker:admin`	Updates a trust policy.
`broker.trust_policies.delete`	`broker:admin`	Deletes a trust policy.
`build.builds.cancel`	`build:run`	Cancels a queued or running Build; its lease is released and nothing is published.
`build.build_caches.update`	`build:write`	Updates a build cache.
`build.build_caches.delete`	`build:write`	Deletes a build cache.
`build.build_caches.purge`	`build:write`	Empties a build cache and keeps the cache. The undo is that the next build refills it.
`config.config_flags.update`	`config:write`	Updates a config flag; the change rolls out in waves and the Operation is done when every cell serves it.
`config.config_flags.delete`	`config:write`	Deletes a config flag; evaluators then get their compiled-in fallback.
`config.config_segments.update`	`config:write`	Updates a config segment; every flag naming it follows.
`config.config_segments.delete`	`config:write`	Deletes a config segment; refused while a flag names it.
`connections.connection_providers.update`	`connections:admin`	Updates a connection provider.
`connections.connection_providers.delete`	`connections:admin`	Deletes a connection provider; force forgets its local connections only.
`connections.connections.update`	`connections:write`	Updates a connection's metadata.
`connections.connections.delete`	`connections:write`	Forgets a connection. The installation itself is removed at the provider.
`data.objects.put`	`data:write`	Writes an object's bytes, replacing the current version. `body` is the base64 of the bytes.
`data.objects.delete`	`data:write`	Deletes an object's current version (history is kept).
`data.kv.put`	`data:write`	Writes a value. Without `ttl_seconds` the namespace default applies; zero means no expiry.
`data.kv.delete`	`data:write`	Deletes a value.
`data.documents.put`	`data:write`	Writes a document to a search index, replacing the current version.
`data.documents.patch`	`data:write`	Changes some fields of a document and keeps the rest: a JSON merge patch (RFC 7396). The version goes up by one.
`data.documents.delete`	`data:write`	Deletes a document.
`data.databases.update`	`data:write`	Updates a database.
`data.databases.delete`	`data:write`	Deletes a database. Fails while `spec.deletion_protection` is set.
`data.databases.rotate_credentials`	`data:write`	Replaces the database's engine credentials; the old ones stop working once the new ones are served.
`data.databases.restore`	`data:write`	Restores the database in place to a point in time inside its retention window; the database is unavailable while it restores.
`data.kv_namespaces.update`	`data:write`	Updates a kv namespace.
`data.kv_namespaces.delete`	`data:write`	Deletes a kv namespace. Fails while `spec.deletion_protection` is set.
`data.kv_namespaces.rotate_credentials`	`data:write`	Replaces the KV namespace's engine credentials; the old ones stop working once the new ones are served.
`data.buckets.update`	`data:write`	Updates a bucket.
`data.buckets.delete`	`data:write`	Deletes a bucket. Fails while `spec.deletion_protection` is set.
`data.buckets.rotate_credentials`	`data:write`	Replaces the bucket's engine credentials; the old ones stop working once the new ones are served.
`data.search_indexes.update`	`data:write`	Updates a search index.
`data.search_indexes.delete`	`data:write`	Deletes a search index. Fails while `spec.deletion_protection` is set.
`data.search_indexes.rotate_credentials`	`data:write`	Replaces the search index's engine credentials; the old ones stop working once the new ones are served.
`events.topics.update`	`events:write`	Updates a topic.
`events.topics.delete`	`events:write`	Deletes a topic.
`events.subscriptions.update`	`events:write`	Updates a subscription.
`events.subscriptions.delete`	`events:write`	Deletes a subscription.
`events.queues.update`	`events:write`	Updates a queue.
`events.queues.delete`	`events:write`	Deletes a queue.
`events.webhook_endpoints.update`	`events:write`	Updates a webhook endpoint.
`events.webhook_endpoints.delete`	`events:write`	Deletes a webhook endpoint.
`events.webhook_endpoints.rotate_secret`	`events:write`	Replaces the endpoint's signing secret and returns the new one, once (`status.signing_secret`). For 24 hours deliveries carry a signature with each secret, so a receiver can switch without dropping one.
`events.inbound_endpoints.update`	`events:write`	Updates an inbound endpoint.
`events.inbound_endpoints.delete`	`events:write`	Deletes an inbound endpoint.
`events.realtime_channels.update`	`events:write`	Updates a realtime channel.
`events.realtime_channels.delete`	`events:write`	Deletes a realtime channel.
`hosting.services.update`	`hosting:write`	Updates a service.
`hosting.services.delete`	`hosting:write`	Deletes a service.
`hosting.service_rollouts.pause`	`hosting:write`	Holds a Rollout at its current wave.
`hosting.service_rollouts.resume`	`hosting:write`	Resumes a paused Rollout.
`hosting.service_rollouts.abort`	`hosting:write`	Stops a Rollout; the cells it reached return to the previous Release.
`hosting.previews.delete`	`hosting:write`	Deletes a preview.
`hosting.source_links.update`	`hosting:write`	Updates a source link.
`hosting.source_links.delete`	`hosting:write`	Deletes a source link.
`keys.keys.update`	`keys:write`	Updates a key's rotation period, deletion protection, or metadata.
`keys.keys.delete`	`keys:write`	Deletes a key and schedules every version's destruction.
`keys.keys.rotate`	`keys:write`	Rotates a key: adds a version and makes it primary. Older versions keep verifying and decrypting until destroyed.
`keys.key_versions.destroy`	`keys:write`	Schedules a key version's destruction after a 24-hour grace; the primary version cannot be destroyed.
`knowledge.spaces.update`	`knowledge:write`	Updates a space.
`knowledge.spaces.delete`	`knowledge:write`	Deletes a space. A space that still holds records is refused with `INVALID_STATE` unless `force` is set, which deletes its episodes and facts too.
`knowledge.knowledge_schemas.update`	`knowledge:write`	Updates a knowledge schema. An accepted update publishes a new revision; a change that would invalidate existing records is refused with `INVALID_FIELD`.
`knowledge.knowledge_schemas.delete`	`knowledge:write`	Deletes a knowledge schema. A schema a space still accepts is refused with `RESOURCE_IN_USE`.
`knowledge.episodes.delete`	`knowledge:write`	Deletes an episode, the facts that cite only it, and its search and embedding entries; facts that also cite other episodes are re-scored.
`knowledge.entities.update`	`knowledge:write`	Updates an entity. With `allow_missing` it is the structured upsert (`upsert_entity`): an entity matched by `external_ids` is updated, otherwise one is created.
`knowledge.entities.delete`	`knowledge:write`	Deletes an entity and every fact about it. With `force` it is a data-rights erasure: the episodes the person wrote are deleted too, with their search and embedding entries.
`knowledge.relations.delete`	`knowledge:write`	Deletes a fact. Deletion is for data that must go; a fact that stopped being true is closed with `:close`.
`knowledge.relations.close`	`knowledge:write`	Closes a fact (`close_fact`): it stopped holding in the world at `valid_end_time`. The fact stays readable for questions about the time before the close.
`localization.catalogs.update`	`localization:write`	Updates a catalog.
`localization.catalogs.delete`	`localization:write`	Deletes a catalog.
`localization.glossaries.update`	`localization:write`	Updates a glossary.
`localization.glossaries.delete`	`localization:write`	Deletes a glossary.
`money.price_catalogs.update`	`billing:write`	Updates the environment's catalog: its features and products, whole.
`money.checkout_policies.update`	`billing:write`	Updates the environment's checkout policy, whole.
`money.store_connections.update`	`billing:write`	Updates a store connection; a new credential replaces the stored one.
`money.store_connections.delete`	`billing:write`	Deletes a store connection and its sealed credential.
`money.merchant_accounts.update`	`billing:write`	Updates the merchant account's own settings: the fields named in `update_mask`.
`money.usage_settings.update`	`billing:write`	Updates the usage settings, the enforcement switch included. A change is recorded with who made it.
`money.usage_tiers.update`	`billing:write`	Creates or updates a usage tier.
`money.usage_meters.update`	`billing:write`	Creates or updates a usage meter. The unit cannot change once it has recorded usage.
`money.revenue_sources.update`	`revenue:write`	Renames, pauses or resumes a revenue source, or changes its settings.
`money.revenue_sources.delete`	`revenue:write`	Deletes a revenue source and the facts it reported. The `money` source cannot be deleted; pause it instead.
`network.domains.update`	`network:write`	Updates a domain.
`network.domains.delete`	`network:write`	Deletes a domain.
`network.routes.update`	`network:write`	Updates a route.
`network.routes.delete`	`network:write`	Deletes a route.
`network.egress_identities.update`	`network:write`	Updates an egress identity.
`network.egress_identities.delete`	`network:write`	Deletes an egress identity.
`network.private_links.update`	`network:write`	Updates a private link.
`network.private_links.delete`	`network:write`	Deletes a private link.
`notify.mail_domains.update`	`notify:write`	Updates an email domain.
`notify.mail_domains.delete`	`notify:write`	Deletes an email domain.
`notify.mail_routes.update`	`notify:write`	Updates a route.
`notify.mail_routes.delete`	`notify:write`	Deletes a route.
`notify.senders.update`	`notify:write`	Updates a sender.
`notify.senders.delete`	`notify:write`	Deletes a sender.
`notify.recipients.update`	`notify:write`	Updates a recipient.
`notify.recipients.delete`	`notify:write`	Deletes a recipient.
`notify.preferences.update`	`notify:write`	Updates a preference.
`notify.preferences.delete`	`notify:write`	Deletes a preference.
`notify.suppressions.delete`	`notify:write`	Deletes a suppression.
`notify.templates.update`	`notify:write`	Updates a template.
`notify.templates.delete`	`notify:write`	Deletes a template.
`notify.mailboxes.update`	`notify:write`	Updates a mailbox.
`notify.mailboxes.delete`	`notify:write`	Deletes a mailbox and its inbound email.
`notify.mailbox_oauth_apps.update`	`notify:write`	Updates a mailbox OAuth app.
`notify.mailbox_oauth_apps.delete`	`notify:write`	Deletes a mailbox OAuth app; refused while a mailbox uses it.
`notify.broadcasts.update`	`notify:write`	Updates a broadcast.
`notify.broadcasts.delete`	`notify:write`	Deletes a broadcast.
`notify.broadcasts.send`	`notify:send`	Sends a Broadcast now.
`notify.broadcasts.cancel`	`notify:send`	Cancels a Broadcast; messages already admitted still deliver.
`observability.error_groups.acknowledge`	`observability:write`	Acknowledges an error group.
`observability.error_groups.resolve`	`observability:write`	Resolves an error group; a new occurrence reopens it.
`observability.error_groups.reopen`	`observability:write`	Reopens a resolved or acknowledged error group.
`observability.scrubbing_policies.update`	`observability:write`	Updates the environment's scrubbing policy.
`runners.scale_sets.update`	`runners:write`	Updates a scale set.
`runners.scale_sets.delete`	`runners:write`	Deletes a scale set.
`sandboxes.pools.update`	`sandboxes:write`	Updates a pool.
`sandboxes.pools.delete`	`sandboxes:write`	Deletes a pool.
`sandboxes.leases.renew`	`sandboxes:write`	Extends `expire_time`, never past the shape's longest lease. Does not change the generation.
`sandboxes.leases.release`	`sandboxes:write`	Ends a lease with END_REASON_RELEASED; the machine is destroyed and never leased again, and attached volumes are detached.
`sandboxes.leases.pause`	`sandboxes:write`	Pauses a lease: its disk is kept and its machine destroyed; the generation increases. Process memory is not kept.
`sandboxes.leases.resume`	`sandboxes:write`	Resumes a paused lease on a machine granted now, or refuses it; the generation increases.
`sandboxes.volumes.update`	`sandboxes:write`	Updates a volume: grows `spec.size_gib` and edits metadata.
`sandboxes.volumes.delete`	`sandboxes:write`	Deletes a volume and destroys its data. Refused RESOURCE_IN_USE while it is attached.
`sandboxes.snapshots.delete`	`sandboxes:write`	Deletes a snapshot.
`secrets.secrets.update`	`secrets:write`	Updates a secret.
`secrets.secrets.delete`	`secrets:write`	Deletes a secret and destroys every version.
`secrets.secret_versions.disable`	`secrets:write`	Disables a secret version: bindings stop delivering it.
`secrets.secret_versions.enable`	`secrets:write`	Enables a disabled secret version.
`secrets.secret_versions.destroy`	`secrets:write`	Destroys a secret version's value irrecoverably.
`secrets.secret_bindings.update`	`secrets:write`	Updates a secret binding.
`secrets.secret_bindings.delete`	`secrets:write`	Deletes a secret binding.
`secrets.profiles.update`	`secrets:write`	Updates a profile's grants or declared paths. Granting a mount is this call: nothing else adds a grant.
`secrets.profiles.delete`	`secrets:write`	Deletes a profile; with `force`, a profile that has versions too, which destroys every version.
`workflows.workflows.update`	`workflows:write`	Updates a workflow.
`workflows.workflows.delete`	`workflows:write`	Deletes a workflow.
`workflows.schedules.update`	`workflows:write`	Updates a schedule; with `allow_missing` it creates the schedule when it does not exist, so its short name `schedule` is an upsert by name.
`workflows.schedules.delete`	`workflows:write`	Deletes a schedule.
`workflows.schedules.pause`	`workflows:write`	Pauses a Schedule: no fire starts a Run until it is resumed.
`workflows.schedules.resume`	`workflows:write`	Resumes a paused Schedule; missed fires follow `catchup_window`.
`workflows.jobs.update`	`workflows:write`	Updates a job. Runs already started keep the generation they pinned.
`workflows.jobs.delete`	`workflows:write`	Deletes a job.
`workflows.distributed_jobs.update`	`workflows:write`	Updates a distributed job. Runs already started keep the generation they pinned.
`workflows.distributed_jobs.delete`	`workflows:write`	Deletes a distributed job.

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links