# Cloudonym > Engine 0.1.3 · rules revision 2026-10-13.3 > Cloud resource naming engine for GCP — generates, corrects and validates names against each provider's physical constraints. > AWS and Azure: planned — not enabled yet. The API answers 400 `request.provider_not_enabled` for them. > For humans (web UI) and for AI coding agents / IaC (`POST /v1/generate` · `POST /v1/names` · `POST /v1/wizard` · `POST /v1/validate` · `GET /openapi.json`). > Cloudonym does not replace the provider's final verdict — it checks only the reserved words and patterns that the official documents state. > People: the API guide is the page `/docs/api` (curl examples, limits, failures); the naming guide is `/docs/naming`. ## Naming Formulas One line per rule: ``: formula · `optional` = tokens dropped first (in this order) when the name is too long. `` defaults to `01` (`count` on `/v1/names` gives `01`…`99`), `` defaults to `sync` (`role` on `/v1/names`), `` is empty unless `kind` on `/v1/names` picks a value with a token (see `## Kind tokens`). `[-]` is filled only by `/v1/wizard` (see `## Tiers`). ### GCP - `gcp.project_id`: `---[-]` · optional: owner - `gcp.project_name`: `---` · optional: owner - `gcp.service_account`: `---sa-` - `gcp.compute_instance`: `----gce[-]-` · optional: region - `gcp.vpc_network`: `---vpc[-]-` - `gcp.subnet`: `----snet-[-]-` · optional: region - `gcp.cloud_sql_instance`: `----sql-[-]-` · optional: region - `gcp.storage_bucket`: `-----gcs[-]` · optional: owner, region - `gcp.firewall_rule`: `---fw-[-]-` - `gcp.disk`: `----disk[-]-` · optional: region - `gcp.address`: `----ip-[-]-` · optional: region - `gcp.autoscaler`: `----as[-]-` · optional: region - `gcp.backend_bucket`: `---bb[-]-` - `gcp.backend_service`: `---bs-[-]-` - `gcp.cross_site_network`: `---csn[-]-` - `gcp.external_vpn_gateway`: `---evg[-]-` - `gcp.forwarding_rule`: `----fwd-[-]-` · optional: region - `gcp.future_reservation`: `----frsv[-]-` · optional: region - `gcp.global_address`: `---ip-[-]-` - `gcp.global_forwarding_rule`: `---fwd-[-]-` - `gcp.global_public_delegated_prefix`: `---pdp[-]-` - `gcp.global_vm_extension_policy`: `---gvep[-]-` - `gcp.health_check`: `---hc-[-]-` - `gcp.http_health_check`: `---hhc[-]-` - `gcp.https_health_check`: `---hhcs[-]-` - `gcp.image`: `---img[-]-` - `gcp.instance_group_manager`: `----mig[-]-` · optional: region - `gcp.instance_group`: `----ig[-]-` · optional: region - `gcp.instance_template`: `---tpl[-]-` - `gcp.instant_snapshot_group`: `----isg[-]-` · optional: region - `gcp.instant_snapshot`: `----isn[-]-` · optional: region - `gcp.interconnect_attachment_group`: `---iag[-]-` - `gcp.interconnect_attachment`: `----vl-[-]-` · optional: region - `gcp.interconnect_group`: `---icg[-]-` - `gcp.interconnect`: `---ic-[-]-` - `gcp.license`: `---lic[-]-` - `gcp.machine_image`: `---mimg[-]-` - `gcp.network_attachment`: `----na[-]-` · optional: region - `gcp.network_edge_security_service`: `----nes[-]-` · optional: region - `gcp.packet_mirroring`: `----pm[-]-` · optional: region - `gcp.public_advertised_prefix`: `---pap[-]-` - `gcp.public_delegated_prefix`: `----pdp[-]-` · optional: region - `gcp.region_autoscaler`: `----as[-]-` · optional: region - `gcp.region_backend_bucket`: `----bb[-]-` · optional: region - `gcp.region_backend_service`: `----bs-[-]-` · optional: region - `gcp.region_commitment`: `----cmt[-]-` · optional: region - `gcp.region_composite_health_check`: `----chc[-]-` · optional: region - `gcp.region_disk`: `----disk[-]-` · optional: region - `gcp.region_health_aggregation_policy`: `----hap[-]-` · optional: region - `gcp.region_health_check`: `----hc-[-]-` · optional: region - `gcp.region_health_check_service`: `----hcs[-]-` · optional: region - `gcp.region_health_source`: `----hs[-]-` · optional: region - `gcp.region_instance_group_manager`: `----mig[-]-` · optional: region - `gcp.region_instance_template`: `----tpl[-]-` · optional: region - `gcp.region_instant_snapshot_group`: `----isg[-]-` · optional: region - `gcp.region_instant_snapshot`: `----isn[-]-` · optional: region - `gcp.region_notification_endpoint`: `----ne[-]-` · optional: region - `gcp.region_security_policy`: `----waf-[-]-` · optional: region - `gcp.region_snapshot`: `----snap[-]-` · optional: region - `gcp.region_ssl_certificate`: `----cert-[-]-` · optional: region - `gcp.region_ssl_policy`: `----sslp[-]-` · optional: region - `gcp.region_target_http_proxy`: `----thp[-]-` · optional: region - `gcp.region_target_https_proxy`: `----thps[-]-` · optional: region - `gcp.region_target_tcp_proxy`: `----ttp[-]-` · optional: region - `gcp.region_url_map`: `----url[-]-` · optional: region - `gcp.reservation`: `----rsv[-]-` · optional: region - `gcp.resource_policy`: `----rp-[-]-` · optional: region - `gcp.rollout_plan`: `---rop[-]-` - `gcp.router`: `----cr[-]-` · optional: region - `gcp.route`: `---rt[-]-` - `gcp.security_policy`: `---waf-[-]-` - `gcp.service_attachment`: `----psc[-]-` · optional: region - `gcp.snapshot`: `---snap-[-]-` - `gcp.ssl_certificate`: `---cert-[-]-` - `gcp.ssl_policy`: `---sslp[-]-` - `gcp.storage_pool`: `----sp[-]-` · optional: region - `gcp.target_grpc_proxy`: `---tgp[-]-` - `gcp.target_http_proxy`: `---thp[-]-` - `gcp.target_https_proxy`: `---thps[-]-` - `gcp.target_instance`: `----ti[-]-` · optional: region - `gcp.target_pool`: `----tp[-]-` · optional: region - `gcp.target_ssl_proxy`: `---tsp[-]-` - `gcp.target_tcp_proxy`: `---ttp[-]-` - `gcp.target_vpn_gateway`: `----tvg[-]-` · optional: region - `gcp.url_map`: `---url[-]-` - `gcp.vpn_gateway`: `----vg[-]-` · optional: region - `gcp.vpn_tunnel`: `----vt[-]-` · optional: region - `gcp.zone_vm_extension_policy`: `----vep[-]-` · optional: region - `gcp.kms_ekm_connection`: `----ekm[-]-` · optional: region - `gcp.kms_key_ring`: `----ring[-]-` · optional: region - `gcp.kms_crypto_key`: `---key[-]-` - `gcp.kms_import_job`: `---ij[-]-` - `gcp.node_group`: `----ng[-]-` · optional: region - `gcp.node_template`: `----nt[-]-` · optional: region - `gcp.network_endpoint_group`: `----neg-[-]-` · optional: region - `gcp.region_network_endpoint_group`: `----neg-[-]-` · optional: region - `gcp.global_network_endpoint_group`: `---neg-[-]-` - `gcp.firestore_database`: `----fs-[-]-` · optional: region - `gcp.spanner_instance`: `----spn[-]-` · optional: region - `gcp.spanner_instance_config`: `custom[-]---` - `gcp.spanner_instance_partition`: `----ptn[-]-` · optional: region - `gcp.spanner_database`: `---spdb-[-]-` - `gcp.spanner_backup`: `---bkp[-]-` - `gcp.gke_cluster`: `----gke-[-]-` · optional: region - `gcp.artifact_registry_repository`: `----ar[-]-` · optional: region - `gcp.artifact_registry_rule`: `---rule[-]-` - `gcp.cloud_function_gen1`: `----gcf[-]-` · optional: region - `gcp.cloud_function`: `----gcf[-]-` · optional: region - `gcp.run_service`: `----run[-]-` · optional: region - `gcp.run_job`: `----crj[-]-` · optional: region - `gcp.iam_oauth_client`: `---oc[-]-` - `gcp.iam_oauth_client_credential`: `---occ[-]-` - `gcp.iam_policy_binding`: `---pb[-]-` - `gcp.iam_principal_access_boundary_policy`: `---pab[-]-` - `gcp.iam_deny_policy`: `---deny[-]-` - `gcp.iam_custom_role`: `role[]` - `gcp.iam_workforce_pool`: `---wfp[-]-` - `gcp.iam_workforce_pool_provider`: `---wfpp-[-]-` - `gcp.iam_workforce_pool_provider_key`: `---wfpk[-]-` - `gcp.iam_workload_identity_pool`: `---wip[-]-` - `gcp.iam_wip_managed_identity`: `---mi[-]-` - `gcp.iam_wip_namespace`: `---ns[-]-` - `gcp.iam_wip_provider`: `---wipp-[-]-` - `gcp.iam_wip_provider_key`: `---wipk[-]-` - `gcp.secret`: `----secret[-]-` · optional: region - `gcp.cloud_sql_database`: `___db[_]_` - `gcp.cloud_sql_user`: `___user_` - `gcp.router_nat`: `---nat[-]-` - `gcp.pubsub_topic`: `---topic[-]-` - `gcp.pubsub_subscription`: `---sub[-]-` - `gcp.cloudbuild_trigger`: `----trigger[-]-` · optional: region - `gcp.dns_managed_zone`: `---dns[-]-` - `gcp.scheduler_job`: `----cron[-]-` · optional: region - `gcp.bigquery_dataset`: `____bq[_]` · optional: region - `gcp.redis_instance`: `----redis[-]-` · optional: region - `gcp.tasks_queue`: `----queue[-]-` · optional: region ## Canonical Allowed Values ### env - `prod` — aliases: prd, production, real, live - `stg` — aliases: stage, staging - `dev` — aliases: develop, development - `sbx` — aliases: sandbox - `qa` — aliases: quality - `uat` — aliases: acceptance - `test` — aliases: testing, tst - `perf` — aliases: performance, load - `dr` — aliases: disaster, recovery ### region - a region or a zone of the provider, by name or by code — see `## Regions` - `global` ## Regions `region` takes a region or a zone of the provider you name, by name or by code, in any case: `asia-northeast3`, `asia-northeast3-a`, `ane3` or `ane3a`, or `global`. Country values such as `kr` and `jp` are rejected (400 `context.value_unsupported`, with the matching region names in `supported`), and so are region names of another provider. On Google Cloud, `us` and `eu` are the multi-region locations below, not countries. Names carry a short region code, not the region name: each region has the code listed below, and a zone name is accepted and resolved to its region (`asia-northeast3-a` and `ane3a` -> `ane3`); names never carry a zone. A region name, zone name or zone code you send is reported once as `context.normalized`. `global` puts no region token in any name. Zonal and regional resources alike carry the region code (or drop it first when the name is too long); global resources carry none. ### GCP - `africa-south1` · `afs1` — Johannesburg, South Africa · zones: `africa-south1-a` `afs1a`, `africa-south1-b` `afs1b`, `africa-south1-c` `afs1c` - `asia-east1` · `ae1` — Changhua County, Taiwan, APAC · zones: `asia-east1-a` `ae1a`, `asia-east1-b` `ae1b`, `asia-east1-c` `ae1c` - `asia-east2` · `ae2` — Hong Kong, APAC · zones: `asia-east2-a` `ae2a`, `asia-east2-b` `ae2b`, `asia-east2-c` `ae2c` - `asia-northeast1` · `ane1` — Tokyo, Japan, APAC · zones: `asia-northeast1-a` `ane1a`, `asia-northeast1-b` `ane1b`, `asia-northeast1-c` `ane1c` - `asia-northeast2` · `ane2` — Osaka, Japan, APAC · zones: `asia-northeast2-a` `ane2a`, `asia-northeast2-b` `ane2b`, `asia-northeast2-c` `ane2c` - `asia-northeast3` · `ane3` — Seoul, South Korea, APAC · zones: `asia-northeast3-a` `ane3a`, `asia-northeast3-b` `ane3b`, `asia-northeast3-c` `ane3c` - `asia-south1` · `as1` — Mumbai, India, APAC · zones: `asia-south1-a` `as1a`, `asia-south1-b` `as1b`, `asia-south1-c` `as1c` - `asia-south2` · `as2` — Delhi, India, APAC · zones: `asia-south2-a` `as2a`, `asia-south2-b` `as2b`, `asia-south2-c` `as2c` - `asia-southeast1` · `ase1` — Jurong West, Singapore, APAC · zones: `asia-southeast1-a` `ase1a`, `asia-southeast1-b` `ase1b`, `asia-southeast1-c` `ase1c` - `asia-southeast2` · `ase2` — Jakarta, Indonesia, APAC · zones: `asia-southeast2-a` `ase2a`, `asia-southeast2-b` `ase2b`, `asia-southeast2-c` `ase2c` - `asia-southeast3` · `ase3` — Bangkok, Thailand, APAC · zones: `asia-southeast3-a` `ase3a`, `asia-southeast3-b` `ase3b`, `asia-southeast3-c` `ase3c` - `australia-southeast1` · `ause1` — Sydney, Australia, APAC · zones: `australia-southeast1-a` `ause1a`, `australia-southeast1-b` `ause1b`, `australia-southeast1-c` `ause1c` - `australia-southeast2` · `ause2` — Melbourne, Australia, APAC · zones: `australia-southeast2-a` `ause2a`, `australia-southeast2-b` `ause2b`, `australia-southeast2-c` `ause2c` - `europe-north1` · `eun1` — Hamina, Finland, Europe · zones: `europe-north1-a` `eun1a`, `europe-north1-b` `eun1b`, `europe-north1-c` `eun1c` - `europe-north2` · `eun2` — Stockholm, Sweden, Europe · zones: `europe-north2-a` `eun2a`, `europe-north2-b` `eun2b`, `europe-north2-c` `eun2c` - `europe-central2` · `euc2` — Warsaw, Poland, Europe · zones: `europe-central2-a` `euc2a`, `europe-central2-b` `euc2b`, `europe-central2-c` `euc2c` - `europe-southwest1` · `eusw1` — Madrid, Spain, Europe · zones: `europe-southwest1-a` `eusw1a`, `europe-southwest1-b` `eusw1b`, `europe-southwest1-c` `eusw1c` - `europe-west1` · `euw1` — St. Ghislain, Belgium, Europe · zones: `europe-west1-b` `euw1b`, `europe-west1-c` `euw1c`, `europe-west1-d` `euw1d` - `europe-west2` · `euw2` — London, England, Europe · zones: `europe-west2-a` `euw2a`, `europe-west2-b` `euw2b`, `europe-west2-c` `euw2c` - `europe-west3` · `euw3` — Frankfurt, Germany, Europe · zones: `europe-west3-a` `euw3a`, `europe-west3-b` `euw3b`, `europe-west3-c` `euw3c` - `europe-west4` · `euw4` — Eemshaven, Netherlands, Europe · zones: `europe-west4-a` `euw4a`, `europe-west4-b` `euw4b`, `europe-west4-c` `euw4c` - `europe-west6` · `euw6` — Zurich, Switzerland, Europe · zones: `europe-west6-a` `euw6a`, `europe-west6-b` `euw6b`, `europe-west6-c` `euw6c` - `europe-west8` · `euw8` — Milan, Italy, Europe · zones: `europe-west8-a` `euw8a`, `europe-west8-b` `euw8b`, `europe-west8-c` `euw8c` - `europe-west9` · `euw9` — Paris, France, Europe · zones: `europe-west9-a` `euw9a`, `europe-west9-b` `euw9b`, `europe-west9-c` `euw9c` - `europe-west10` · `euw10` — Berlin, Germany, Europe · zones: `europe-west10-a` `euw10a`, `europe-west10-b` `euw10b`, `europe-west10-c` `euw10c` - `europe-west12` · `euw12` — Turin, Italy, Europe · zones: `europe-west12-a` `euw12a`, `europe-west12-b` `euw12b`, `europe-west12-c` `euw12c` - `me-central1` · `mec1` — Doha, Qatar, Middle East · zones: `me-central1-a` `mec1a`, `me-central1-b` `mec1b`, `me-central1-c` `mec1c` - `me-central2` · `mec2` — Dammam, Saudi Arabia, Middle East · zones: `me-central2-a` `mec2a`, `me-central2-b` `mec2b`, `me-central2-c` `mec2c` - `me-west1` · `mew1` — Tel Aviv, Israel, Middle East · zones: `me-west1-a` `mew1a`, `me-west1-b` `mew1b`, `me-west1-c` `mew1c` - `northamerica-northeast1` · `nane1` — Montréal, Québec, North America · zones: `northamerica-northeast1-a` `nane1a`, `northamerica-northeast1-b` `nane1b`, `northamerica-northeast1-c` `nane1c` - `northamerica-northeast2` · `nane2` — Toronto, Ontario, North America · zones: `northamerica-northeast2-a` `nane2a`, `northamerica-northeast2-b` `nane2b`, `northamerica-northeast2-c` `nane2c` - `northamerica-south1` · `nas1` — Queretaro, Mexico, North America · zones: `northamerica-south1-a` `nas1a`, `northamerica-south1-b` `nas1b`, `northamerica-south1-c` `nas1c` - `southamerica-east1` · `sae1` — Osasco, São Paulo, Brazil, South America · zones: `southamerica-east1-a` `sae1a`, `southamerica-east1-b` `sae1b`, `southamerica-east1-c` `sae1c` - `southamerica-west1` · `saw1` — Santiago, Chile, South America · zones: `southamerica-west1-a` `saw1a`, `southamerica-west1-b` `saw1b`, `southamerica-west1-c` `saw1c` - `us-central1` · `usc1` — Council Bluffs, Iowa, North America · zones: `us-central1-a` `usc1a`, `us-central1-b` `usc1b`, `us-central1-c` `usc1c`, `us-central1-f` `usc1f` - `us-east1` · `use1` — Moncks Corner, South Carolina, North America · zones: `us-east1-b` `use1b`, `us-east1-c` `use1c`, `us-east1-d` `use1d` - `us-east4` · `use4` — Ashburn, Virginia, North America · zones: `us-east4-a` `use4a`, `us-east4-b` `use4b`, `us-east4-c` `use4c` - `us-east5` · `use5` — Columbus, Ohio, North America · zones: `us-east5-a` `use5a`, `us-east5-b` `use5b`, `us-east5-c` `use5c` - `us-south1` · `uss1` — Dallas, Texas, North America · zones: `us-south1-a` `uss1a`, `us-south1-b` `uss1b`, `us-south1-c` `uss1c` - `us-west1` · `usw1` — The Dalles, Oregon, North America · zones: `us-west1-a` `usw1a`, `us-west1-b` `usw1b`, `us-west1-c` `usw1c` - `us-west2` · `usw2` — Los Angeles, California, North America · zones: `us-west2-a` `usw2a`, `us-west2-b` `usw2b`, `us-west2-c` `usw2c` - `us-west3` · `usw3` — Salt Lake City, Utah, North America · zones: `us-west3-a` `usw3a`, `us-west3-b` `usw3b`, `us-west3-c` `usw3c` - `us-west4` · `usw4` — Las Vegas, Nevada, North America · zones: `us-west4-a` `usw4a`, `us-west4-b` `usw4b`, `us-west4-c` `usw4c` Multi-region and dual-region locations (D78): `region` (and `location` on a `/v1/wizard` pick) also takes these, by name or code in any case, but only for the resource types listed on each line — names carry the lower-case code in the region slot (`…-prod-us-gcs`). Any other type with a region token is 400 `context.location_unsupported` on `/v1/generate` (which names every type, so always) and `/v1/names`, and `wizard.invalid_location` on a wizard pick; the wizard project region stays a single region. - `US` · `us` — multi-region · Data centers in the United States · for `storage_bucket`, `bigquery_dataset` · https://docs.cloud.google.com/storage/docs/locations#location-mr · https://docs.cloud.google.com/bigquery/docs/locations#multi-regions - `EU` · `eu` — multi-region · Data centers within member states of the European Union · for `storage_bucket`, `bigquery_dataset` · https://docs.cloud.google.com/storage/docs/locations#location-mr · https://docs.cloud.google.com/bigquery/docs/locations#multi-regions - `ASIA` · `asia` — multi-region · Data centers in Asia, excluding Hong Kong and Indonesia · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#location-mr - `ASIA1` · `asia1` — dual-region · Tokyo + Osaka (asia-northeast1 + asia-northeast2) · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#predefined - `EUR4` · `eur4` — dual-region · Finland + Netherlands (europe-north1 + europe-west4) · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#predefined - `EUR5` · `eur5` — dual-region · Belgium + London (europe-west1 + europe-west2) · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#predefined - `EUR7` · `eur7` — dual-region · London + Frankfurt (europe-west2 + europe-west3) · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#predefined - `EUR8` · `eur8` — dual-region · Frankfurt + Zürich (europe-west3 + europe-west6) · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#predefined - `NAM4` · `nam4` — dual-region · Iowa + South Carolina (us-central1 + us-east1) · for `storage_bucket` · https://docs.cloud.google.com/storage/docs/locations#predefined Secret Manager secrets (`secret`, D79) carry no region token by default: a secret has no location unless it is created as a regional secret (`projects/*/locations/*/secrets`), so its name ignores the context region and a location never fails it. On a `/v1/wizard` pick, `location: "regional"` puts the project region in its name (`…-prod-ane3-secret-01`); with a `global` project region that is 400 `wizard.location_needs_region`. ## Kind tokens `kind` on `/v1/names` takes a value name from the list below (`POSTGRES`, `snapshot-schedule`), not the token. The token goes right after the abbreviation: `…---`. The provider default of the scope, and values marked (no token), add no token even when sent. A rule that needs a kind (`required`) comes back `valid: false` with `name.kind_required` without one; `/v1/names` rejects that request first (400 `selection.kind_required`). One kind per item. Each line: the catalogue row, its values (value → token), the kind rule, the basis for the provider default and the date the sources were last checked. Under it, one line per rule (scope): its default and the values it accepts — the same value can be accepted in one scope and not another. ### GCP - `gcp.subnet` · slug `snet`: `PRIVATE` (no token) · `REGIONAL_MANAGED_PROXY` → `proxy` · `GLOBAL_MANAGED_PROXY` → `proxy` · `PRIVATE_SERVICE_CONNECT` → `psc` · `PRIVATE_NAT` → `nat` — omitted when it is the provider default · basis: API Subnetwork.purpose: PRIVATE = "Regular user created or automatically created subnet" · checked 2026-10-07 - `gcp.subnet` (region): default `PRIVATE` · accepts `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PRIVATE_NAT` - `gcp.cloud_sql_instance` · slug `sql`: `MYSQL` (no token) · `POSTGRES` → `pg` · `SQLSERVER` → `ms` — omitted when it is the provider default · basis: gcloud sql instances create --database-version default="MYSQL_8_0" (terraform: required) · checked 2026-10-07 - `gcp.cloud_sql_instance` (project): default `MYSQL` · accepts `MYSQL`, `POSTGRES`, `SQLSERVER` - `gcp.firewall_rule` · slug `fw`: `INGRESS` (no token) · `EGRESS` → `egr` — omitted when it is the provider default · basis: gcloud --direction: "If direction is NOT specified, then default is to apply on incoming traffic" · checked 2026-10-07 - `gcp.firewall_rule` (global): default `INGRESS` · accepts `INGRESS`, `EGRESS` - `gcp.address` · slug `ip`: `EXTERNAL` (no token) · `INTERNAL` → `int` — omitted when it is the provider default · basis: terraform google_compute_address.address_type "Default value: EXTERNAL" · checked 2026-10-07 - `gcp.address` (region): default `EXTERNAL` · accepts `EXTERNAL`, `INTERNAL` - `gcp.global_address` (global): default `EXTERNAL` · accepts `EXTERNAL`, `INTERNAL` - `gcp.backend_service` · slug `bs`: `EXTERNAL` (no token) · `EXTERNAL_MANAGED` (no token) · `INTERNAL` → `int` · `INTERNAL_MANAGED` → `int` · `INTERNAL_SELF_MANAGED` → `int` — omitted when it is the provider default · basis: gcloud --load-balancing-scheme default="EXTERNAL" · checked 2026-10-08 - `gcp.backend_service` (global): default `EXTERNAL` · accepts `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL_MANAGED`, `INTERNAL_SELF_MANAGED` - `gcp.region_backend_service` (region): default `EXTERNAL` · accepts `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL`, `INTERNAL_MANAGED`, `INTERNAL_SELF_MANAGED` - `gcp.forwarding_rule` · slug `fwd`: `EXTERNAL` (no token) · `EXTERNAL_MANAGED` (no token) · `INTERNAL` → `int` · `INTERNAL_MANAGED` → `int` · `INTERNAL_SELF_MANAGED` → `int` — omitted when it is the provider default · basis: gcloud --load-balancing-scheme: "defaults to EXTERNAL" · checked 2026-10-08 - `gcp.forwarding_rule` (region): default `EXTERNAL` · accepts `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL`, `INTERNAL_MANAGED` - `gcp.global_forwarding_rule` (global): default `EXTERNAL` · accepts `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL_MANAGED`, `INTERNAL_SELF_MANAGED` - `gcp.health_check` · slug `hc`: `grpc` → `grpc` · `grpc-with-tls` → `grpcs` · `http` → `http` · `http2` → `h2` · `https` → `https` · `ssl` → `ssl` · `tcp` → `tcp` — only when chosen · basis: protocol is a gcloud subcommand; no default · checked 2026-10-07 - `gcp.health_check` (global): no default · accepts `grpc`, `grpc-with-tls`, `http`, `http2`, `https`, `ssl`, `tcp` - `gcp.region_health_check` (region): no default · accepts `grpc`, `grpc-with-tls`, `http`, `http2`, `https`, `ssl`, `tcp` - `gcp.interconnect_attachment` · slug `vl`: `DEDICATED` → `ded` · `PARTNER` → `par` · `PARTNER_PROVIDER` → `pp` · `L2_DEDICATED` → `l2` — only when chosen · basis: gcloud splits into attachments dedicated | partner subcommands; no default · checked 2026-10-07 - `gcp.interconnect_attachment` (region): no default · accepts `DEDICATED`, `PARTNER`, `PARTNER_PROVIDER`, `L2_DEDICATED` - `gcp.interconnect` · slug `ic`: `DEDICATED` → `ded` · `PARTNER` → `par` · `IT_PRIVATE` → `itp` — only when chosen · basis: gcloud --interconnect-type "must be one of"; terraform required · checked 2026-10-07 - `gcp.interconnect` (global): no default · accepts `DEDICATED`, `PARTNER`, `IT_PRIVATE` - `gcp.security_policy` · slug `waf`: `CLOUD_ARMOR` → `ca` · `CLOUD_ARMOR_EDGE` → `edg` · `CLOUD_ARMOR_NETWORK` → `net` — only when chosen · basis: gcloud --type has no default · checked 2026-10-07 - `gcp.region_security_policy` (region): no default · accepts `CLOUD_ARMOR`, `CLOUD_ARMOR_NETWORK` - `gcp.security_policy` (global): no default · accepts `CLOUD_ARMOR`, `CLOUD_ARMOR_EDGE` - `gcp.ssl_certificate` · slug `cert`: `SELF_MANAGED` → `self` · `MANAGED` → `mgd` — only when chosen · basis: gcloud --certificate vs --domains; separate terraform resources · checked 2026-10-07 - `gcp.region_ssl_certificate` (region): no default · accepts `SELF_MANAGED` - `gcp.ssl_certificate` (global): no default · accepts `SELF_MANAGED`, `MANAGED` - `gcp.resource_policy` · slug `rp`: `snapshot-schedule` → `snap` · `instance-schedule` → `isc` · `group-placement` → `plc` · `disk-consistency-group` → `dcg` · `workload-policy` → `wkl` — required · basis: one policy is one kind; without the kind the name has no meaning · checked 2026-10-07 - `gcp.resource_policy` (region): no default · accepts `snapshot-schedule`, `instance-schedule`, `group-placement`, `disk-consistency-group`, `workload-policy` - `gcp.snapshot` · slug `snap`: `STANDARD` (no token) · `ARCHIVE` → `arc` — omitted when it is the provider default · basis: gcloud --snapshot-type: "If a snapshot type is not specified, a STANDARD snapshot will be created" · checked 2026-10-07 - `gcp.snapshot` (global): default `STANDARD` · accepts `STANDARD`, `ARCHIVE` - `gcp.network_endpoint_group` · slug `neg`: `GCE_VM_IP_PORT` (no token) · `SERVERLESS` (no token) · `GCE_VM_IP` → `vmip` · `GCE_VM_IP_PORTMAP` → `pmap` · `GCE_VM_IP_DEDICATED_BACKEND` → `ded` · `NON_GCP_PRIVATE_IP_PORT` → `hyb` · `INTERNET_IP_PORT` → `inet` · `INTERNET_FQDN_PORT` → `fqdn` · `PRIVATE_SERVICE_CONNECT` → `psc` — omitted when it is the provider default · basis: zonal: gcloud default="gce-vm-ip-port", terraform "Default value: GCE_VM_IP_PORT"; regional: terraform "Default value: SERVERLESS"; global: no default (choose) · checked 2026-10-07 - `gcp.network_endpoint_group` (zone): default `GCE_VM_IP_PORT` · accepts `GCE_VM_IP_PORT`, `GCE_VM_IP`, `NON_GCP_PRIVATE_IP_PORT`, `GCE_VM_IP_DEDICATED_BACKEND` - `gcp.global_network_endpoint_group` (global): no default · accepts `INTERNET_IP_PORT`, `INTERNET_FQDN_PORT` - `gcp.region_network_endpoint_group` (region): default `SERVERLESS` · accepts `SERVERLESS`, `PRIVATE_SERVICE_CONNECT`, `GCE_VM_IP_PORTMAP`, `INTERNET_IP_PORT`, `INTERNET_FQDN_PORT` - `gcp.firestore_database` · slug `fs`: `FIRESTORE_NATIVE` (no token) · `DATASTORE_MODE` → `ds` — omitted when it is the provider default · basis: gcloud --type default="firestore-native" (terraform: required) · checked 2026-10-07 - `gcp.firestore_database` (project): default `FIRESTORE_NATIVE` · accepts `FIRESTORE_NATIVE`, `DATASTORE_MODE` - `gcp.spanner_database` · slug `spdb`: `GOOGLE_STANDARD_SQL` (no token) · `POSTGRESQL` → `pg` — omitted when it is the provider default · basis: gcloud --database-dialect: "GOOGLE_STANDARD_SQL is the default" · checked 2026-10-07 - `gcp.spanner_database` (in spanner_instance): default `GOOGLE_STANDARD_SQL` · accepts `GOOGLE_STANDARD_SQL`, `POSTGRESQL` - `gcp.gke_cluster` · slug `gke`: `STANDARD` → `std` · `AUTOPILOT` → `auto` — only when chosen · basis: gcloud container clusters create vs create-auto; no default · checked 2026-10-07 - `gcp.gke_cluster` (location): no default · accepts `STANDARD`, `AUTOPILOT` - `gcp.iam_workforce_pool_provider` · slug `wfpp`: `OIDC` → `oidc` · `SAML` → `saml` — only when chosen · basis: gcloud providers create-oidc | create-saml; no default · checked 2026-10-07 - `gcp.iam_workforce_pool_provider` (in workforce_pool): no default · accepts `OIDC`, `SAML` - `gcp.iam_wip_provider` · slug `wipp`: `OIDC` → `oidc` · `SAML` → `saml` · `AWS` → `aws` · `X509` → `x509` — only when chosen · basis: gcloud providers create-oidc | create-saml | create-aws | create-x509; no default · checked 2026-10-07 - `gcp.iam_wip_provider` (in workload_identity_pool): no default · accepts `OIDC`, `SAML`, `AWS`, `X509` ## Tiers A tier is a short purpose token (`web`, `was`) that only `/v1/wizard` fills. It goes after the abbreviation and kind token and before the sequence number: `[-]` in the formulas, for example `billing-shop-prod-ane3-gce-web-01`. Rules with a sequence number (`input: count`) take it there; on Google Cloud, rules with neither a sequence number nor a role (Cloud Storage bucket, BigQuery dataset, Spanner instance config, IAM custom role) take it right after the abbreviation, so two of them in one service can be told apart (`platform-billing-shop-prod-ane3-gcs-uploads`). Role rules and the project ID never take one. It is never shortened or dropped. A preset brings its own tier; `tier` on a pick overrides it. `/v1/generate` and `/v1/names` never put a tier in a name. - `` = `^[a-z0-9]{2,16}$` - rejected with 400 `wizard.invalid_tier` when it does not match, and `wizard.tier_reserved` when it is one of the reserved words below: abbreviations, kind tokens, environment values and their aliases, and region and zone codes — they would read as that token - reserved: `acceptance` `ae1` `ae1a` `ae1b` `ae1c` `ae2` `ae2a` `ae2b` `ae2c` `afs1` `afs1a` `afs1b` `afs1c` `ane1` `ane1a` `ane1b` `ane1c` `ane2` `ane2a` `ane2b` `ane2c` `ane3` `ane3a` `ane3b` `ane3c` `ar` `arc` `as` `as1` `as1a` `as1b` `as1c` `as2` `as2a` `as2b` `as2c` `ase1` `ase1a` `ase1b` `ase1c` `ase2` `ase2a` `ase2b` `ase2c` `ase3` `ase3a` `ase3b` `ase3c` `asia` `asia1` `ause1` `ause1a` `ause1b` `ause1c` `ause2` `ause2a` `ause2b` `ause2c` `auto` `aws` `bb` `bkp` `bq` `bs` `ca` `cert` `chc` `cmt` `cr` `crj` `cron` `csn` `custom` `db` `dcg` `ded` `deny` `dev` `develop` `development` `disaster` `disk` `dns` `dr` `ds` `edg` `egr` `ekm` `eu` `euc2` `euc2a` `euc2b` `euc2c` `eun1` `eun1a` `eun1b` `eun1c` `eun2` `eun2a` `eun2b` `eun2c` `eur4` `eur5` `eur7` `eur8` `eusw1` `eusw1a` `eusw1b` `eusw1c` `euw1` `euw10` `euw10a` `euw10b` `euw10c` `euw12` `euw12a` `euw12b` `euw12c` `euw1b` `euw1c` `euw1d` `euw2` `euw2a` `euw2b` `euw2c` `euw3` `euw3a` `euw3b` `euw3c` `euw4` `euw4a` `euw4b` `euw4c` `euw6` `euw6a` `euw6b` `euw6c` `euw8` `euw8a` `euw8b` `euw8c` `euw9` `euw9a` `euw9b` `euw9c` `evg` `fqdn` `frsv` `fs` `fw` `fwd` `gce` `gcf` `gcs` `gke` `grpc` `grpcs` `gvep` `h2` `hap` `hc` `hcs` `hhc` `hhcs` `hs` `http` `https` `hyb` `iag` `ic` `icg` `ig` `ij` `img` `inet` `int` `ip` `isc` `isg` `isn` `itp` `key` `l2` `lic` `live` `load` `mec1` `mec1a` `mec1b` `mec1c` `mec2` `mec2a` `mec2b` `mec2c` `mew1` `mew1a` `mew1b` `mew1c` `mgd` `mi` `mig` `mimg` `ms` `na` `nam4` `nane1` `nane1a` `nane1b` `nane1c` `nane2` `nane2a` `nane2b` `nane2c` `nas1` `nas1a` `nas1b` `nas1c` `nat` `ne` `neg` `nes` `net` `ng` `ns` `nt` `oc` `occ` `oidc` `pab` `pap` `par` `pb` `pdp` `perf` `performance` `pg` `plc` `pm` `pmap` `pp` `prd` `prod` `production` `proxy` `psc` `ptn` `qa` `quality` `queue` `real` `recovery` `redis` `ring` `role` `rop` `rp` `rsv` `rt` `rule` `run` `sa` `sae1` `sae1a` `sae1b` `sae1c` `saml` `sandbox` `saw1` `saw1a` `saw1b` `saw1c` `sbx` `secret` `self` `snap` `snet` `sp` `spdb` `spn` `sql` `ssl` `sslp` `stage` `staging` `std` `stg` `sub` `tcp` `test` `testing` `tgp` `thp` `thps` `ti` `topic` `tp` `tpl` `trigger` `tsp` `tst` `ttp` `tvg` `uat` `url` `us` `usc1` `usc1a` `usc1b` `usc1c` `usc1f` `use1` `use1b` `use1c` `use1d` `use4` `use4a` `use4b` `use4c` `use5` `use5a` `use5b` `use5c` `user` `uss1` `uss1a` `uss1b` `uss1c` `usw1` `usw1a` `usw1b` `usw1c` `usw2` `usw2a` `usw2b` `usw2c` `usw3` `usw3a` `usw3b` `usw3c` `usw4` `usw4a` `usw4b` `usw4c` `vep` `vg` `vl` `vmip` `vpc` `vt` `waf` `wfp` `wfpk` `wfpp` `wip` `wipk` `wipp` `wkl` `x509` - preset tokens: `web` `was` `bastion` `file` `redir` `ssh` `icmp` `iap` `lbhc` `psa` ## Attached resources A server slot on `/v1/wizard` can carry attached resources. Their name is the final name of the parent plus a suffix, so they inherit its region, tier and sequence; they are never shortened. If the result is too long the attached item is `valid: false` with `name.cannot_fit` and `name.parent_name`; if the parent is not valid the attached item comes back with an empty name and `name.parent_invalid`. Data disks take their own numbers (`data: ["01", "02"]`, 1 to 9). - `-boot` · attach `boot` on `gcp.compute_instance` → `gcp.disk` - `-data-` · attach `data` on `gcp.compute_instance` → `gcp.disk` - `-ip` · attach `ip` on `gcp.compute_instance` → `gcp.address` - `-ipi` · attach `ipi` on `gcp.compute_instance` → `gcp.address` ## Wizard presets `preset` on a `/v1/wizard` pick. Each preset is one rule; `preset: null` with `rule` picks any other rule. Network presets (VPC, subnet, firewall, Cloud Router, Cloud NAT) are usually project-level (`project_picks`); the load balancer parts are separate presets, one name each. A working set of them is listed under "Wizard cards" below. At most 20 services and 40 picks per service or in `project_picks`. - `web` (Web server) → `gcp.compute_instance`, tier `web`, serverless: `gcp.cloud_function` or `gcp.run_service`; `was` (App server) → `gcp.compute_instance`, tier `was`, serverless: `gcp.cloud_function` or `gcp.run_service`; `bastion` (Bastion) → `gcp.compute_instance`, tier `bastion` · HA (`ha: true`) on `web` and `was` as virtual machines only: at least 2 servers - `file` (File server) → `gcp.compute_instance`, tier `file`, the screen starts it with data disk `01` - `db` (Database (Cloud SQL)) → `gcp.cloud_sql_instance` - `object` (Object storage) → `gcp.storage_bucket` - `run` (Cloud Run service) → `gcp.run_service` - `sa` (Service account) → `gcp.service_account` - `secret` (Secret) → `gcp.secret` - `gke` (GKE cluster) → `gcp.gke_cluster` - `wip` (Workload Identity pool) → `gcp.iam_workload_identity_pool` - `ip` (Global IP address) → `gcp.global_address`; `ig` (Instance group) → `gcp.instance_group`; `bs` (Backend service) → `gcp.backend_service`; `hc` (Health check) → `gcp.health_check`; `url` (URL map) → `gcp.url_map`; `cert` (SSL certificate) → `gcp.ssl_certificate`; `thps` (Target HTTPS proxy) → `gcp.target_https_proxy`; `fwd` (Forwarding rule) → `gcp.global_forwarding_rule`; `urlredir` (Redirect URL map (HTTP to HTTPS)) → `gcp.url_map`, tier `redir`; `thp` (Target HTTP proxy) → `gcp.target_http_proxy`; `fwdredir` (Forwarding rule (HTTP, port 80)) → `gcp.global_forwarding_rule`, tier `redir`; `neg` (Serverless NEG) → `gcp.region_network_endpoint_group`; `bb` (Backend bucket) → `gcp.backend_bucket` - `vpc` (VPC network) → `gcp.vpc_network`; `subnet` (Subnet) → `gcp.subnet`; `firewall` (Firewall rule) → `gcp.firewall_rule`, tier `ssh` (or `web`, `icmp`, `iap`, `lbhc`); `router` (Cloud Router) → `gcp.router`; `nat` (Cloud NAT) → `gcp.router_nat`; `psa` (Private services access range) → `gcp.global_address`, tier `psa` ## Wizard cards A card on the wizard screen adds a working set of presets at once. Cards are not part of `/v1/wizard`: send the same picks to get the same names. Project parts go in `project_picks`; the rest in the service. - `website` (Website): `web`, `ig`, `hc`, `bs`, `ip`, `url`, `cert`, `thps`, `fwd`, `urlredir`, `thp`, `fwdredir` · project: `firewall` tier `web`, `firewall` tier `lbhc` · options: Database (Cloud SQL) (`db`, `psa`, on by default); App server (`was`); Bastion (`bastion`, `firewall` tier `ssh`, `firewall` tier `iap`) · built and tested on Google Cloud - `serverless-web` (Serverless web): `run`, `neg`, `bs`, `ip`, `url`, `cert`, `thps`, `fwd`, `urlredir`, `thp`, `fwdredir` · options: Database (Cloud SQL) (`db`, `psa`); Service account (`sa`); Secret (`secret`) · built and tested on Google Cloud - `static-site` (Static site): `object`, `bb`, `ip`, `url`, `cert`, `thps`, `fwd`, `urlredir`, `thp`, `fwdredir` · built and tested on Google Cloud - `vm-app` (Internal app on VMs): `web`, `was`, `db` · project: `firewall` tier `ssh`, `firewall` tier `icmp`, `firewall` tier `iap`, `psa` · options: Bastion (`bastion`, on by default); File server (`file`); Object storage (`object`) · built and tested on Google Cloud - `https-lb` (HTTPS load balancer): `ip`, `url`, `cert`, `thps`, `fwd`, `urlredir`, `thp`, `fwdredir` · plus one backend by what the service has: `web` → `ig`, `hc`, `bs`, `firewall` tier `web`, `firewall` tier `lbhc`; `run` → `neg`, `bs`; `object` → `bb` · rules verified, the set not yet applied One load balancer card per service (shared parts such as `ip` and `url` would be duplicate picks); add another service for a second one. ## Provider Constraints ### GCP - `gcp.project_id` (Project ID): 6-30 chars · pattern `^[a-z][a-z0-9-]{4,28}[a-z0-9]$` · forbidden: contains google ssl · docs: https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects#identifiers - `gcp.project_name` (Project Name): 4-30 chars · pattern `^[A-Za-z0-9' !-]{3,29}[A-Za-z0-9]$` · docs: https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects#identifiers - `gcp.service_account` (Service Account): 6-30 chars · pattern `^[a-z][a-z0-9-]{4,28}[a-z0-9]$` · docs: https://docs.cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/create - `gcp.compute_instance` (Compute Engine Instance): 1-63 chars · pattern `^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$` · note: VM names must be unique across the project unless its vmDnsSetting is ZonalOnly, so this rule is placed at project scope although the API path is zones/{zone}/instances · docs: https://docs.cloud.google.com/compute/docs/naming-resources - `gcp.vpc_network` (VPC Network): 1-63 chars · pattern `^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/networks#Network.FIELDS.name - `gcp.subnet` (Subnet): 1-63 chars · pattern `^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/subnetworks#Subnetwork.FIELDS.name - `gcp.cloud_sql_instance` (Cloud SQL Instance): 1-67 chars · pattern `^[a-z]([a-z0-9-]*[a-z0-9])?$` · note: The provider limits project-id:instance-id to 98 characters; the instance ID alone is capped at 67 (98 minus the longest project ID, 30, minus 1). The alphanumeric-end requirement is a conservative limit with no documented source (D20) · docs: https://docs.cloud.google.com/sql/docs/mysql/instance-settings - `gcp.storage_bucket` (Cloud Storage Bucket): 3-63 chars · pattern `^[a-z0-9][a-z0-9._-]{1,61}[a-z0-9]$` · forbidden: prefixes goog; contains google g00gle ..; no IPv4 form · note: Dotted names may be up to 222 characters, but the engine never generates dots and keeps 63 (conservative, D20) · docs: https://docs.cloud.google.com/storage/docs/buckets#naming - `gcp.firewall_rule` (VPC Firewall Rule): 1-63 chars · pattern `^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls#Firewall.FIELDS.name - `gcp.disk` (Persistent Disk): 1-63 chars · pattern `^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/disks#Disk.FIELDS.name - `gcp.address` (Address): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/addresses#Address.FIELDS.name - `gcp.autoscaler` (Autoscaler): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/autoscalers#Autoscaler.FIELDS.name - `gcp.backend_bucket` (Backend Bucket): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/backendBuckets#BackendBucket.FIELDS.name - `gcp.backend_service` (Backend Service): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/backendServices#BackendService.FIELDS.name - `gcp.cross_site_network` (Cross Site Network): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/crossSiteNetworks/insert#body.request_body.FIELDS.name - `gcp.external_vpn_gateway` (External VPN Gateway): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/externalVpnGateways#ExternalVpnGateway.FIELDS.name - `gcp.forwarding_rule` (Forwarding Rule): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/forwardingRules#ForwardingRule.FIELDS.name - `gcp.future_reservation` (Future Reservation): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/futureReservations/insert#body.request_body.FIELDS.name - `gcp.global_address` (Address (global)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/globalAddresses#Address.FIELDS.name - `gcp.global_forwarding_rule` (Forwarding Rule (global)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/globalForwardingRules#ForwardingRule.FIELDS.name - `gcp.global_public_delegated_prefix` (Public Delegated Prefix (global)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/globalPublicDelegatedPrefixes/insert#body.request_body.FIELDS.name - `gcp.global_vm_extension_policy` (Global VM Extension Policy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/globalVmExtensionPolicies/insert#body.request_body.FIELDS.name - `gcp.health_check` (Health Check): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/healthChecks#HealthCheck.FIELDS.name - `gcp.http_health_check` (HTTP Health Check): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/httpHealthChecks#HttpHealthCheck.FIELDS.name - `gcp.https_health_check` (HTTPS Health Check): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/httpsHealthChecks#HttpsHealthCheck.FIELDS.name - `gcp.image` (Image): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/images#Image.FIELDS.name - `gcp.instance_group_manager` (Instance Group Manager): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/instanceGroupManagers#InstanceGroupManager.FIELDS.name - `gcp.instance_group` (Instance Group): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/instanceGroups#InstanceGroup.FIELDS.name - `gcp.instance_template` (Instance Template): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/instanceTemplates#InstanceTemplate.FIELDS.name - `gcp.instant_snapshot_group` (Instant Snapshot Group): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/instantSnapshotGroups#InstantSnapshotGroup.FIELDS.name - `gcp.instant_snapshot` (Instant Snapshot): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/instantSnapshots#InstantSnapshot.FIELDS.name - `gcp.interconnect_attachment_group` (Interconnect Attachment Group): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/interconnectAttachmentGroups/insert#body.request_body.FIELDS.name - `gcp.interconnect_attachment` (Interconnect Attachment): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/interconnectAttachments#InterconnectAttachment.FIELDS.name - `gcp.interconnect_group` (Interconnect Group): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/interconnectGroups/insert#body.request_body.FIELDS.name - `gcp.interconnect` (Interconnect): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/interconnects#Interconnect.FIELDS.name - `gcp.license` (License): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/licenses#License.FIELDS.name - `gcp.machine_image` (Machine Image): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/machineImages#MachineImage.FIELDS.name - `gcp.network_attachment` (Network Attachment): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/networkAttachments/insert#body.request_body.FIELDS.name - `gcp.network_edge_security_service` (Network Edge Security Service): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/networkEdgeSecurityServices#NetworkEdgeSecurityService.FIELDS.name - `gcp.packet_mirroring` (Packet Mirroring): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/packetMirrorings#PacketMirroring.FIELDS.name - `gcp.public_advertised_prefix` (Public Advertised Prefix): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/publicAdvertisedPrefixes/insert#body.request_body.FIELDS.name - `gcp.public_delegated_prefix` (Public Delegated Prefix): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/publicDelegatedPrefixes/insert#body.request_body.FIELDS.name - `gcp.region_autoscaler` (Autoscaler (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionAutoscalers#Autoscaler.FIELDS.name - `gcp.region_backend_bucket` (Backend Bucket (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionBackendBuckets/insert#body.request_body.FIELDS.name - `gcp.region_backend_service` (Backend Service (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionBackendServices#BackendService.FIELDS.name - `gcp.region_commitment` (Commitment (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionCommitments#Commitment.FIELDS.name - `gcp.region_composite_health_check` (Composite Health Check (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionCompositeHealthChecks#CompositeHealthCheck.FIELDS.name - `gcp.region_disk` (Disk (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionDisks#Disk.FIELDS.name - `gcp.region_health_aggregation_policy` (Health Aggregation Policy (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionHealthAggregationPolicies#HealthAggregationPolicy.FIELDS.name - `gcp.region_health_check` (Health Check (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionHealthChecks#HealthCheck.FIELDS.name - `gcp.region_health_check_service` (Health Check Service (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionHealthCheckServices#HealthCheckService.FIELDS.name - `gcp.region_health_source` (Health Source (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionHealthSources#HealthSource.FIELDS.name - `gcp.region_instance_group_manager` (Instance Group Manager (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionInstanceGroupManagers#InstanceGroupManager.FIELDS.name - `gcp.region_instance_template` (Instance Template (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionInstanceTemplates#InstanceTemplate.FIELDS.name - `gcp.region_instant_snapshot_group` (Instant Snapshot Group (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionInstantSnapshotGroups/insert#body.request_body.FIELDS.name - `gcp.region_instant_snapshot` (Instant Snapshot (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionInstantSnapshots/insert#body.request_body.FIELDS.name - `gcp.region_notification_endpoint` (Notification Endpoint (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionNotificationEndpoints#NotificationEndpoint.FIELDS.name - `gcp.region_security_policy` (Security Policy (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionSecurityPolicies#SecurityPolicy.FIELDS.name - `gcp.region_snapshot` (Snapshot (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionSnapshots/insert#body.request_body.FIELDS.name - `gcp.region_ssl_certificate` (SSL Certificate (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionSslCertificates#SslCertificate.FIELDS.name - `gcp.region_ssl_policy` (SSL Policy (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionSslPolicies#SslPolicy.FIELDS.name - `gcp.region_target_http_proxy` (Target HTTP Proxy (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionTargetHttpProxies#TargetHttpProxy.FIELDS.name - `gcp.region_target_https_proxy` (Target HTTPS Proxy (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionTargetHttpsProxies#TargetHttpsProxy.FIELDS.name - `gcp.region_target_tcp_proxy` (Target TCP Proxy (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionTargetTcpProxies#TargetTcpProxy.FIELDS.name - `gcp.region_url_map` (URL Map (regional)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/regionUrlMaps#UrlMap.FIELDS.name - `gcp.reservation` (Reservation): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/reservations#Reservation.FIELDS.name - `gcp.resource_policy` (Resource Policy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies#ResourcePolicy.FIELDS.name - `gcp.rollout_plan` (Rollout Plan): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/rolloutPlans#RolloutPlan.FIELDS.name - `gcp.router` (Router): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/routers#Router.FIELDS.name - `gcp.route` (Route): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/routes#Route.FIELDS.name - `gcp.security_policy` (Security Policy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/securityPolicies#SecurityPolicy.FIELDS.name - `gcp.service_attachment` (Service Attachment): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/serviceAttachments#ServiceAttachment.FIELDS.name - `gcp.snapshot` (Snapshot): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/snapshots#Snapshot.FIELDS.name - `gcp.ssl_certificate` (SSL Certificate): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/sslCertificates#SslCertificate.FIELDS.name - `gcp.ssl_policy` (SSL Policy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/sslPolicies#SslPolicy.FIELDS.name - `gcp.storage_pool` (Storage Pool): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/storagePools#StoragePool.FIELDS.name - `gcp.target_grpc_proxy` (Target gRPC Proxy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetGrpcProxies#TargetGrpcProxy.FIELDS.name - `gcp.target_http_proxy` (Target HTTP Proxy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetHttpProxies#TargetHttpProxy.FIELDS.name - `gcp.target_https_proxy` (Target HTTPS Proxy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetHttpsProxies#TargetHttpsProxy.FIELDS.name - `gcp.target_instance` (Target Instance): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetInstances#TargetInstance.FIELDS.name - `gcp.target_pool` (Target Pool): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetPools#TargetPool.FIELDS.name - `gcp.target_ssl_proxy` (Target SSL Proxy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetSslProxies#TargetSslProxy.FIELDS.name - `gcp.target_tcp_proxy` (Target TCP Proxy): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetTcpProxies#TargetTcpProxy.FIELDS.name - `gcp.target_vpn_gateway` (Target VPN Gateway): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/targetVpnGateways#TargetVpnGateway.FIELDS.name - `gcp.url_map` (URL Map): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/urlMaps#UrlMap.FIELDS.name - `gcp.vpn_gateway` (VPN Gateway): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/vpnGateways#VpnGateway.FIELDS.name - `gcp.vpn_tunnel` (VPN Tunnel): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/vpnTunnels#VpnTunnel.FIELDS.name - `gcp.zone_vm_extension_policy` (VM Extension Policy (zonal)): 1-63 chars · pattern `^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/zoneVmExtensionPolicies/insert#body.request_body.FIELDS.name - `gcp.kms_ekm_connection` (Cloud KMS EKM Connection): 1-63 chars · pattern `^(?:[a-zA-Z0-9_-]{1,63})$` · docs: https://docs.cloud.google.com/kms/docs/reference/rest/v1/projects.locations.ekmConnections/create#query-parameters - `gcp.kms_key_ring` (Cloud KMS Key Ring): 1-63 chars · pattern `^(?:[a-zA-Z0-9_-]{1,63})$` · docs: https://docs.cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings/create#query-parameters - `gcp.kms_crypto_key` (Cloud KMS Crypto Key): 1-63 chars · pattern `^(?:[a-zA-Z0-9_-]{1,63})$` · docs: https://docs.cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys/create#query-parameters - `gcp.kms_import_job` (Cloud KMS Import Job): 1-63 chars · pattern `^(?:[a-zA-Z0-9_-]{1,63})$` · docs: https://docs.cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.importJobs/create#query-parameters - `gcp.node_group` (Node Group): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.node_template` (Node Template): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.network_endpoint_group` (Network Endpoint Group): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.region_network_endpoint_group` (Region Network Endpoint Group): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.global_network_endpoint_group` (Global Network Endpoint Group): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.firestore_database` (Firestore Database): 4-63 chars · pattern `^(?![0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$)[a-z][a-z0-9-]{2,61}[a-z0-9]$` · docs: https://cloud.google.com/firestore/docs/reference/rest/v1/projects.databases/create - `gcp.spanner_instance` (Spanner Instance): 2-64 chars · pattern `^[a-z][-a-z0-9]{0,62}[a-z0-9]$` · docs: https://cloud.google.com/spanner/docs/reference/rest/v1/projects.instances/create - `gcp.spanner_instance_config` (Spanner Instance Config): 8-64 chars · pattern `^custom-(?:[-a-z0-9]{0,56}[a-z0-9])$` · docs: https://cloud.google.com/spanner/quotas - `gcp.spanner_instance_partition` (Spanner Instance Partition): 2-64 chars · pattern `^[a-z][-a-z0-9]{0,62}[a-z0-9]$` · docs: https://cloud.google.com/spanner/docs/reference/rest/v1/projects.instances.instancePartitions/create - `gcp.spanner_database` (Spanner Database): 2-30 chars · pattern `^[a-z][a-z0-9_-]{0,28}[a-z0-9]$` · docs: https://cloud.google.com/spanner/docs/reference/rest/v1/projects.instances.databases/create - `gcp.spanner_backup` (Spanner Backup): 2-60 chars · pattern `^[a-z][a-z0-9_-]{0,58}[a-z0-9]$` · docs: https://cloud.google.com/spanner/docs/reference/rest/v1/projects.instances.backups - `gcp.gke_cluster` (GKE Cluster): 1-40 chars · pattern `^[a-z](?:[a-z0-9-]{0,38}[a-z0-9])?$` · docs: https://www.googleapis.com/discovery/v1/apis/container/v1/rest - `gcp.artifact_registry_repository` (Artifact Registry Repository): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · note: The documentation states no length or characters; the rule is the one the API enforced on a real request, checked on 2026-10-12 (D80) · docs: https://docs.cloud.google.com/artifact-registry/docs/repositories/create-repos - `gcp.artifact_registry_rule` (Artifact Registry Rule): 1-256 chars · pattern `^(?:[A-Za-z0-9._~:@+^-]|%[0-9A-Fa-f]{2})+$` · note: Official sources disagree on this rule; the narrower one is used (conservative, D20) · docs: https://docs.cloud.google.com/artifact-registry/docs/restrict-artifact-downloads#gcloud - `gcp.cloud_function_gen1` (Cloud Function (1st gen)): 1-63 chars · pattern `^[A-Za-z](?:[A-Za-z0-9_-]{0,61}[A-Za-z0-9])?$` · docs: https://cloud.google.com/functions/1stgendocs/deploy - `gcp.cloud_function` (Cloud Function (2nd gen)): 4-63 chars · pattern `^[a-z][a-z0-9-]{2,61}[a-z0-9]$` · note: Official sources disagree on this rule; the narrower one is used (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://cloud.google.com/functions/docs/reference/rest/v2/projects.locations.functions/create - `gcp.run_service` (Cloud Run Service): 1-49 chars · pattern `^[a-z]([a-z0-9-]*[a-z0-9])?$` · note: The create request states no limits; length and characters come from another page of the same API reference (conservative, D20) · docs: https://docs.cloud.google.com/run/docs/reference/rest/v2/projects.locations.services/create - `gcp.run_job` (Cloud Run Job): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · note: The documentation states no length or characters; the rule is the one the API enforced on a real request, checked on 2026-10-12 (D80) · docs: https://docs.cloud.google.com/run/docs/create-jobs - `gcp.iam_oauth_client` (IAM OAuth Client): 6-63 chars · pattern `^[a-z][a-z0-9-]{4,61}[a-z0-9]$` · forbidden: prefixes gcp- · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_oauth_client_credential` (IAM OAuth Client Credential): 4-32 chars · pattern `^[a-z0-9-]{4,32}$` · forbidden: prefixes gcp- · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_policy_binding` (IAM Policy Binding): 3-63 chars · pattern `^[a-z][a-z0-9.-]{2,62}$` · note: Official sources disagree on this rule; the narrower one is used (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://cloud.google.com/iam/docs/reference/rest/v3/projects.locations.policyBindings/create - `gcp.iam_principal_access_boundary_policy` (IAM Principal Access Boundary Policy): 3-63 chars · pattern `^[a-z][a-z0-9.-]{2,62}$` · note: Official sources disagree on this rule; the narrower one is used (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://cloud.google.com/iam/docs/reference/rest/v3/organizations.locations.principalAccessBoundaryPolicies/create - `gcp.iam_deny_policy` (IAM Deny Policy): 3-63 chars · pattern `^[a-z][a-z0-9.-]{2,62}$` · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://iam.googleapis.com/$discovery/rest?version=v2 - `gcp.iam_custom_role` (IAM Custom Role): 3-64 chars · pattern `^[A-Za-z0-9_.]{3,64}$` · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_workforce_pool` (IAM Workforce Pool): 6-63 chars · pattern `^[a-z][a-z0-9-]{4,61}[a-z0-9]$` · forbidden: prefixes gcp- · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_workforce_pool_provider` (IAM Workforce Pool Provider): 4-32 chars · pattern `^[a-z0-9-]{4,32}$` · forbidden: prefixes gcp- · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_workforce_pool_provider_key` (IAM Workforce Pool Provider Key): 4-32 chars · pattern `^[a-z0-9-]{4,32}$` · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_workload_identity_pool` (IAM Workload Identity Pool): 4-32 chars · pattern `^[a-z0-9-]{4,32}$` · forbidden: prefixes gcp- · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_wip_managed_identity` (IAM Workload Identity Pool Managed Identity): 1-63 chars · pattern `^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$` · forbidden: prefixes gcp- · note: The documentation recommends against this form rather than forbidding it; it is rejected here (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_wip_namespace` (IAM Workload Identity Pool Namespace): 1-63 chars · pattern `^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$` · forbidden: prefixes gcp- · note: The documentation recommends against this form rather than forbidding it; it is rejected here (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_wip_provider` (IAM Workload Identity Pool Provider): 4-32 chars · pattern `^[a-z0-9-]{4,32}$` · forbidden: prefixes gcp- · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_wip_provider_key` (IAM Workload Identity Pool Provider Key): 4-32 chars · pattern `^[a-z0-9-]{4,32}$` · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.secret` (Secret Manager Secret): 1-255 chars · pattern `^[A-Za-z0-9_-]{1,255}$` · docs: https://www.googleapis.com/discovery/v1/apis/secretmanager/v1/rest - `gcp.cloud_sql_database` (Cloud SQL Database): 1-63 chars · pattern `^[a-z][a-z0-9_]{0,62}$` · note: Official sources disagree on this rule; the narrower one is used (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://docs.cloud.google.com/sql/docs/mysql/create-manage-databases#create - `gcp.cloud_sql_user` (Cloud SQL User): 1-32 chars · pattern `^[a-z][a-z0-9_]{0,31}$` · forbidden: prefixes pg_; exact root cloudsqlreplica cloudsqlimport cloudsqlexport cloudsqloneshot cloudsqlapplier cloudsqlobservabilityadmin cloudiamgroup cloudsqlreadonly cloudsqlreplicaindex cloudsqladmin cloudsqlagent cloudsqlconnpooladmin cloudsqlimportexport cloudsqllogical cloudsqlobservability cloudsqliamgroup cloudsqlinactiveuser cloudsqliamgroupserviceaccount cloudsqliamgroupuser cloudsqliamserviceaccount cloudsqlsuperuser sqlserver · note: Official sources disagree on this rule; the narrower one is used (conservative, D20); The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://docs.cloud.google.com/sql/docs/mysql/create-manage-users#create-user - `gcp.router_nat` (Cloud NAT): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/routers#Router.FIELDS.inlinedField_48 - `gcp.pubsub_topic` (Pub/Sub Topic): 3-255 chars · pattern `^[A-Za-z][A-Za-z0-9_.~+%-]{2,254}$` · forbidden: prefixes goog · docs: https://docs.cloud.google.com/pubsub/docs/pubsub-basics#resource_names - `gcp.pubsub_subscription` (Pub/Sub Subscription): 3-255 chars · pattern `^[A-Za-z][A-Za-z0-9_.~+%-]{2,254}$` · forbidden: prefixes goog · docs: https://docs.cloud.google.com/pubsub/docs/pubsub-basics#resource_names - `gcp.cloudbuild_trigger` (Cloud Build Trigger): 1-64 chars · pattern `^[A-Za-z0-9](?:[A-Za-z0-9-]{0,62}[A-Za-z0-9])?$` · docs: https://docs.cloud.google.com/build/docs/api/reference/rest/v1/projects.locations.triggers#BuildTrigger.FIELDS.name - `gcp.dns_managed_zone` (Cloud DNS Managed Zone): 1-63 chars · pattern `^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$` · docs: https://docs.cloud.google.com/dns/docs/reference/rest/v1/managedZones#ManagedZone.FIELDS.name - `gcp.scheduler_job` (Cloud Scheduler Job): 1-500 chars · pattern `^[A-Za-z0-9_-]{1,500}$` · docs: https://docs.cloud.google.com/scheduler/docs/reference/rest/v1/projects.locations.jobs#Job.FIELDS.name - `gcp.bigquery_dataset` (BigQuery Dataset): 1-1024 chars · pattern `^[A-Za-z0-9_]{1,1024}$` · docs: https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/datasets#DatasetReference.FIELDS.dataset_id - `gcp.redis_instance` (Memorystore for Redis Instance): 1-40 chars · pattern `^[a-z](?:[a-z0-9-]{0,38}[a-z0-9])?$` · docs: https://docs.cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances/create#body.QUERY_PARAMETERS.instance_id - `gcp.tasks_queue` (Cloud Tasks Queue): 1-100 chars · pattern `^[A-Za-z0-9-]{1,100}$` · note: The documentation does not say within what this name must be unique, so the scope shown here is not confirmed · docs: https://docs.cloud.google.com/tasks/docs/reference/rest/v2/projects.locations.queues#Queue.FIELDS.name ## Resource tree Where each resource is created, from the widest scope down. Under each scope: its rules (`input` = what `/v1/names` accepts for that rule: `count` 1-99, `role`, or `none`), then its child scopes. scope is the placement scope: the parent the resource is created in (a scope id such as azure:resource_group). It says where the name lives, not that the provider enforces uniqueness there; see uniqueness. uniqueness "csp" means the provider requires the name to be unique within its scope; "none" (AWS Name tags) means the provider does not enforce uniqueness at all. Cloudonym compares names only with each other inside one request (name.conflict), never with resources that already exist. ### GCP - Global namespace (`gcp:namespace`) — docs: https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects#identifiers - `gcp.project_id` · input: none - `gcp.project_name` · input: none · uniqueness: none - `gcp.storage_bucket` · input: none - `gcp.iam_principal_access_boundary_policy` · input: count - `gcp.iam_workforce_pool` · input: count - Project (`gcp:project`) — docs: https://docs.cloud.google.com/compute/docs/naming-resources - `gcp.service_account` · input: role - `gcp.compute_instance` · input: count - `gcp.cloud_sql_instance` · input: count - `gcp.firestore_database` · input: count - `gcp.spanner_instance` · input: count - `gcp.spanner_instance_config` · input: none - `gcp.iam_deny_policy` · input: count - `gcp.iam_custom_role` · input: none - `gcp.secret` · input: count - `gcp.pubsub_topic` · input: count - `gcp.pubsub_subscription` · input: count - `gcp.cloudbuild_trigger` · input: count - `gcp.dns_managed_zone` · input: count - `gcp.scheduler_job` · input: count - `gcp.bigquery_dataset` · input: none - Global (`gcp:project_global`) — docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.vpc_network` · input: count - `gcp.firewall_rule` · input: count - `gcp.backend_bucket` · input: count - `gcp.backend_service` · input: count - `gcp.cross_site_network` · input: count - `gcp.external_vpn_gateway` · input: count - `gcp.global_address` · input: count - `gcp.global_forwarding_rule` · input: count - `gcp.global_public_delegated_prefix` · input: count - `gcp.global_vm_extension_policy` · input: count - `gcp.health_check` · input: count - `gcp.http_health_check` · input: count - `gcp.https_health_check` · input: count - `gcp.image` · input: count - `gcp.instance_template` · input: count - `gcp.interconnect_attachment_group` · input: count - `gcp.interconnect_group` · input: count - `gcp.interconnect` · input: count - `gcp.license` · input: count - `gcp.machine_image` · input: count - `gcp.public_advertised_prefix` · input: count - `gcp.rollout_plan` · input: count - `gcp.route` · input: count - `gcp.security_policy` · input: count - `gcp.snapshot` · input: count - `gcp.ssl_certificate` · input: count - `gcp.ssl_policy` · input: count - `gcp.target_grpc_proxy` · input: count - `gcp.target_http_proxy` · input: count - `gcp.target_https_proxy` · input: count - `gcp.target_ssl_proxy` · input: count - `gcp.target_tcp_proxy` · input: count - `gcp.url_map` · input: count - `gcp.global_network_endpoint_group` · input: count - Region (`gcp:project_region`) — docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.subnet` · input: count - `gcp.address` · input: count - `gcp.forwarding_rule` · input: count - `gcp.interconnect_attachment` · input: count - `gcp.network_attachment` · input: count - `gcp.network_edge_security_service` · input: count - `gcp.packet_mirroring` · input: count - `gcp.public_delegated_prefix` · input: count - `gcp.region_autoscaler` · input: count - `gcp.region_backend_bucket` · input: count - `gcp.region_backend_service` · input: count - `gcp.region_commitment` · input: count - `gcp.region_composite_health_check` · input: count - `gcp.region_disk` · input: count - `gcp.region_health_aggregation_policy` · input: count - `gcp.region_health_check` · input: count - `gcp.region_health_check_service` · input: count - `gcp.region_health_source` · input: count - `gcp.region_instance_group_manager` · input: count - `gcp.region_instance_template` · input: count - `gcp.region_instant_snapshot_group` · input: count - `gcp.region_instant_snapshot` · input: count - `gcp.region_notification_endpoint` · input: count - `gcp.region_security_policy` · input: count - `gcp.region_snapshot` · input: count - `gcp.region_ssl_certificate` · input: count - `gcp.region_ssl_policy` · input: count - `gcp.region_target_http_proxy` · input: count - `gcp.region_target_https_proxy` · input: count - `gcp.region_target_tcp_proxy` · input: count - `gcp.region_url_map` · input: count - `gcp.resource_policy` · input: count - `gcp.router` · input: count - `gcp.service_attachment` · input: count - `gcp.target_pool` · input: count - `gcp.target_vpn_gateway` · input: count - `gcp.vpn_gateway` · input: count - `gcp.vpn_tunnel` · input: count - `gcp.node_template` · input: count - `gcp.region_network_endpoint_group` · input: count - Cloud Router (`gcp:router`) — docs: https://docs.cloud.google.com/compute/docs/reference/rest/v1/routers#Router.FIELDS.inlinedField_48 - `gcp.router_nat` · input: count - Zone (`gcp:project_zone`) — docs: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest - `gcp.disk` · input: count - `gcp.autoscaler` · input: count - `gcp.future_reservation` · input: count - `gcp.instance_group_manager` · input: count - `gcp.instance_group` · input: count - `gcp.instant_snapshot_group` · input: count - `gcp.instant_snapshot` · input: count - `gcp.reservation` · input: count - `gcp.storage_pool` · input: count - `gcp.target_instance` · input: count - `gcp.zone_vm_extension_policy` · input: count - `gcp.node_group` · input: count - `gcp.network_endpoint_group` · input: count - Location (`gcp:project_location`) — docs: https://docs.cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings/create#query-parameters - `gcp.kms_ekm_connection` · input: count - `gcp.kms_key_ring` · input: count - `gcp.gke_cluster` · input: count - `gcp.artifact_registry_repository` · input: count - `gcp.cloud_function_gen1` · input: count - `gcp.cloud_function` · input: count - `gcp.run_service` · input: count - `gcp.run_job` · input: count - `gcp.iam_oauth_client` · input: count - `gcp.iam_oauth_client_credential` · input: count - `gcp.iam_policy_binding` · input: count - `gcp.iam_workload_identity_pool` · input: count - `gcp.redis_instance` · input: count - `gcp.tasks_queue` · input: count - Key ring (`gcp:kms_key_ring`) — docs: https://docs.cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys/create#query-parameters - `gcp.kms_crypto_key` · input: count - `gcp.kms_import_job` · input: count - Workload identity pool (`gcp:workload_identity_pool`) — docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_wip_managed_identity` · input: count - `gcp.iam_wip_namespace` · input: count - `gcp.iam_wip_provider` · input: count - `gcp.iam_wip_provider_key` · input: count - Artifact Registry repository (`gcp:artifact_registry_repository`) — docs: https://docs.cloud.google.com/artifact-registry/docs/restrict-artifact-downloads#gcloud - `gcp.artifact_registry_rule` · input: count - Spanner instance (`gcp:spanner_instance`) — docs: https://cloud.google.com/spanner/docs/reference/rest/v1/projects.instances.instancePartitions/create - `gcp.spanner_instance_partition` · input: count - `gcp.spanner_database` · input: count - `gcp.spanner_backup` · input: count - Cloud SQL instance (`gcp:cloud_sql_instance`) — docs: https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/databases#Database.FIELDS.name - `gcp.cloud_sql_database` · input: count - `gcp.cloud_sql_user` · input: role - Workforce pool (`gcp:workforce_pool`) — docs: https://www.googleapis.com/discovery/v1/apis/iam/v1/rest - `gcp.iam_workforce_pool_provider` · input: count - `gcp.iam_workforce_pool_provider_key` · input: count ## What PASS means PASS / `valid: true` means the name satisfies the documented naming checks of this rules revision (length, pattern, reserved words). It does not mean the name is available or that you may create it — uniqueness, permissions, quotas and organisation policy are not checked. Generated names are not guaranteed unique: shortening can map two different contexts to the same name. ## API - `POST /v1/generate` — body `{ "context": { "owner", "system", "purpose", "env", "region" }, "providers"?: ["gcp"], "rules_version"?: string }` - `POST /v1/names` — body `{ "provider", "context": { … }, "resources": [{ "type", "count"?: 1-99, "role"?: string, "kind"?: string }], "rules_version"?: string }` — only the resources you pick; `data.` is `{ valid, items[], conflicts[] }`. Each item carries `key`, `resource_type`, `seq` or `role`, `kind` and `kind_token` when a kind was picked (`kind_token` only when the name carries one), `scope`, `uniqueness` and the same fields as a `/v1/generate` name (limits: see `## Limits`) - `POST /v1/wizard` — body `{ "provider", "project": { "owner", "system", "env", "region" }, "project_id_suffix"?: string, "project_picks"?: [pick], "services"?: [{ "purpose", "picks": [pick] }], "rules_version"?: string }` with pick `{ "preset": id | null, "rule"?: rule id, "tier"?, "role"?, "kind"?, "ha"?: boolean, "serverless"?: rule id, "instances"?: [{ "id", "seq", "attach"?: { "boot"?: true, "data"?: [seq], "ip"?: true, "ipi"?: true } }] }` — one project: the project ID first (with `project_id_suffix` appended as a protected token when given — same pattern and reserved words as a tier; project IDs are global and permanent, and Cloudonym cannot check whether one is free), then project-level items, then each service; each parent is followed by its attached resources. `data.` is `{ valid, items[], conflicts[] }`; items carry a structured `key` (`service/shop/compute_instance/-/web/01/data/01`), `namespace` (`project` or the service), `level`, `tier`, `parent` and `attach` when they apply, and the `/v1/names` item fields. `metadata.generated_labels.` maps each namespace to its labels (the `project` labels have no `purpose`). A 400 names the offending element in `field` with the request names (`project_picks[0].instances[0].attach.data[1]`); errors about the whole plan have no `field`. A plan file (see `## Plan file`) is this body The wizard response is not reproduced through `/v1/names`: the wizard response is reproduced by repeating the same wizard request with its `rules_version`; `/v1/names` is a separate, flat endpoint. - `POST /v1/validate` — body `{ "provider", "resource_type", "name", "rules_version"?: string }` - `GET /v1/health` — `{ "ok": true, "version": { "engine", "rules" } }` - `GET /openapi.json` — OpenAPI 3.0.3 - `GET /catalog.json` — the resource catalog of the enabled providers as JSON: one row per resource with its rule ids, abbreviation, kinds and kind tokens, region-token kind (`none` or `region`), description and search aliases, the region and zone codes, and `version: { engine, rules }`; each rule also says what a wizard pick of it takes (`input`: `count`, `role` or `none`; `tier`; `locations`), and each provider lists the wizard `presets`, the `attachments` of a server slot and the request `limits` (see `## catalog.json fields`) `/v1/generate` is the catalogue (every rule of the providers, sequence `01`, no kind); `/v1/names` is the selection. Rules that need a kind come back `valid: false` there (`name.kind_required`) — use `/v1/names` with `kind` for them. One `/v1/names` request stands for one instance of each parent scope (one resource group, one project, one VPC): names that collide inside the request (same kind of resource, same name; Azure and AWS compare case-insensitively) are each marked `valid: false` with `name.conflict`, and `conflicts` lists each collision once. Two resource groups are two requests. Successful responses of `/v1/generate`, `/v1/names`, `/v1/wizard`, `/v1/validate` and `/v1/health` carry `version: { engine, rules }` (failures and `/v1/events` do not). `violations`, `steps`, `errors`, `rule.notes` and the label lists are arrays of `{ code, field?, params?, message }` — branch on `code`, show `message` to people. `rules_version` pins a request to a rules revision: if it differs from the current one the API answers 409 `request.rules_version_mismatch` instead of returning names that may differ. The API never serves an old rules revision — store the names you created and keep using them. Every failure (400, 403, 404, 409, 413, 429, 500) has the same shape: `{ "success": false, "errors": [{ code, field?, params?, message }], "supported"?: [...] }`. An unknown `/v1` path or method is 404 `request.not_found`. ## Limits - Request body: at most 32768 bytes on `POST /v1/*`. A larger body is 413 `request.body_too_large` with `params: { max_bytes }`, before the body is read. A saved plan file fits (see `## Plan file`). - Rate limit: 60 requests per 60 seconds per client IP, counted together across every `POST /v1/*`, `GET /llms.txt` and `GET /catalog.json`. `GET /v1/health` and `GET /openapi.json` are not counted. Over the limit the answer is 429 `request.rate_limited` with `Retry-After: 60` (seconds) — wait that long, then send again. - Fields: `owner`, `system` and `purpose` are at most 64 characters; `env`, `region` and the other strings at most 1024. A longer value is 400 `request.field_too_long`. - `/v1/names`: At most 200 resources and 200 names per request. `/v1/wizard`: at most 200 names including the project ID. - Errors: a `POST /v1/wizard` or `POST /v1/generate` 400 lists at most the first 50 errors; when there are more, the last entry is `request.errors_truncated` with `params: { shown, total }` — fix those and send again to see the rest. `/v1/names`, `/v1/validate` and `/v1/events` list every error. - Echoed values: a user value echoed in an error (`params.value`, `params.requested` and the `message` built from them) is cut to 40 characters followed by `…`; control, bidirectional and zero-width characters appear as `\uXXXX`. Lists such as `supported` are never cut. ## Plan file A plan file is the `POST /v1/wizard` request body plus two fields. Its fields: `provider`, `project`, `project_id_suffix` (optional), `project_picks`, `services` (as in the request), `rules_version` and `environments` (optional). `rules_version` is always there (the rules revision when it was saved); `environments` is there only when the plan has two or more environments, and `project.env` is the first of them. - The API ignores `environments` and names one environment, `project.env`: to name every environment, send one request per environment with `project.env` changed. With one environment the file is a request body as it stands (`curl -d @file`). `rules_version` pins the request: a 409 means the rules changed since the file was saved. - Requests carry at most 32768 bytes; a saved file is indented, so send a large plan compacted (`jq -c .`). - Fields the API does not know are ignored, so the same file gives the same names on the web and from the API; an unknown field inside `attach` is the exception (400). - JSON Schema: `GET /plan.schema.json`. - On the web, **Save plan** downloads the current plan as `cloudonym-plan--.json`, and **Open plan** loads such a file the way a share link opens (invalid picks are left out and counted). Open plan does not read files over 176,548 bytes, the most a share link can hold. ## catalog.json fields `GET /catalog.json` is what a client reads to build a `/v1/wizard` pick or a plan file without keeping its own copy of the rules. The limits are guidance before sending — the API's answer is the verdict. - per rule (`providers..rows[].rules.`): `input` — what a pick of it takes: `count` (numbered servers in `instances[]`), `role` (a `role`) or `none`; `tier` — `true` when the name has a tier slot (see `## Tiers`); `locations` — the values a pick may send as `location`, only on rules that take one - `presets` (per provider): the wizard presets in request names — `id`, `label`, `rule`, `tier`, `ha`, `serverless`, `level`, `default_attach`, `group`, `tier_choices` and `kind`; send `id` as `preset` - `attachments` (per provider): what a server slot can carry — `parent`, `attach`, `child` and `seq` (see `## Attached resources`) - `limits` (per provider): `max_services`, `max_picks_per_service`, `max_names`, `max_count`, `max_data_disks`, `max_body_bytes`, `seq_pattern`, `slot_id_pattern`, `tier_pattern` and `role_pattern` ## CLI The source repository has a command-line tool. It is not published to npm: run it from a clone with `node cli/cloudonym.mjs ` (Node 22, no dependencies). It holds no naming rules — it edits a plan file and asks `POST /v1/wizard` for every name and verdict, and reads presets, rule inputs and limits from `/catalog.json`, so it gives the same names as the web and the API for the same rules revision. - Server: `--server ` or `CLOUDONYM_SERVER`; there is no default. - Files: the plan file (default `cloudonym.plan.json`, `-f` to choose) and the names kept next to it (`cloudonym.plan.names.json`). - `init` — a new plan file (`--owner --system --env E[,E2] --region`, `rules_version` from the server) or `--from ` to copy a file saved with Save plan - `add` — appends a pick (a preset, a rule id or a resource name) to a service (`--service `) or the project (`--project`), or numbered servers to the same pick; it writes the file only if every existing name and verdict stays the same in every environment and every new name passes, otherwise it exits 1 and leaves the file as it was. It never edits an existing pick. `--dry-run` checks without writing - `names` — every name, one request per environment; `--new` only names not yet kept, `--repin` re-pins `rules_version` after a 409; `--no-write` writes neither the plan nor the names file - `validate` — exit 0 when every name is valid and matches the kept names - On 429 it prints `Retry-After`; `--wait` waits that long and retries once per command. - Saving holds `.lock` next to the file from the last check to the replace; while it exists another command does not write (exit 2). If no command is running, a left-over lock is from one that stopped: delete it. If the file is saved but its lock cannot be removed, the command says so, names the lock and exits 2. - Exit codes: 0 ok · 1 a name FAILs or add would change existing names or verdicts · 2 plan, names file or arguments rejected (400, 413), a file cannot be read or written, it changed while the command ran, or its lock could not be removed after saving · 3 rules_version differs (409) · 4 server unreachable, 429, 5xx or an answer that cannot be interpreted · 64 usage · 70 internal error Paths are relative to the host that served this file.