firebaseappcheck

v2026.04.23.1

Google Cloud firebaseappcheck infrastructure models

Repository

https://github.com/systeminit/swamp-extensions

Platforms

linux-x86_64 linux-aarch64 darwin-x86_64 darwin-aarch64

Labels

gcpgoogle-cloudfirebaseappcheckcloudinfrastructure

models

Quality score

Verified by Swamp

How well-documented and verifiable this extension is.

Grade A

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types1/1earned
Has description1/1earned
At least one platform tag (or universal)1/1earned
Two or more platform tags (or universal)1/1earned
License declared1/1earned
Verified public repository2/2earned

Install

$ swamp extension pull @swamp/gcp/firebaseappcheck

@swamp/gcp/firebaseappcheck/apps-appattestconfigv2026.04.23.1apps_appattestconfig.ts

Global Arguments

Argument	Type	Required	Description
name?	string	no	Required. The relative resource name of the App Attest configuration object, in the format: ` projects/{project_number}/apps/{app_id}/appAttestConfig `
tokenTtl?	string	no	Specifies the duration for which App Check tokens exchanged from App Attest artifacts will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

getGet a appAttestConfig

Argument	Type	Required	Description
identifier	string	yes	The name of the appAttestConfig

updateUpdate appAttestConfig attributes

syncSync appAttestConfig state from GCP

batch_getbatch get

Resources

state(infinite)— An app's App Attest configuration object. This configuration controls certain...

@swamp/gcp/firebaseappcheck/apps-debugtokensv2026.04.23.1apps_debugtokens.ts

Global Arguments

Argument	Type	Required	Description
displayName?	string	no	Required. A human readable display name used to identify this debug token.
name?	string	no	Required. The relative resource name of the debug token, in the format: ` projects/{project_number}/apps/{app_id}/debugTokens/{debug_token_id} `
token?	string	no	Required. Input only. Immutable. The secret token itself. Must be provided during creation, and must be a UUID4, case insensitive. This field is immutable once set, and cannot be provided during an UpdateDebugToken request. You can, however, delete this debug token using DeleteDebugToken to revoke it. For security reasons, this field will never be populated in any response.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

createCreate a debugTokens

getGet a debugTokens

Argument	Type	Required	Description
identifier	string	yes	The name of the debugTokens

updateUpdate debugTokens attributes

deleteDelete the debugTokens

Argument	Type	Required	Description
identifier	string	yes	The name of the debugTokens

syncSync debugTokens state from GCP

Resources

state(infinite)— A *debug token* is a secret used during the development or integration testin...

@swamp/gcp/firebaseappcheck/apps-devicecheckconfigv2026.04.23.1apps_devicecheckconfig.ts

Global Arguments

Argument	Type	Required	Description
keyId?	string	no	Required. The key identifier of a private key enabled with DeviceCheck, created in your Apple Developer account.
name?	string	no	Required. The relative resource name of the DeviceCheck configuration object, in the format: ` projects/{project_number}/apps/{app_id}/deviceCheckConfig `
privateKey?	string	no	Required. Input only. The contents of the private key (`.p8`) file associated with the key specified by `key_id`. For security reasons, this field will never be populated in any response.
privateKeySet?	boolean	no	Output only. Whether the `private_key` field was previously set. Since we will never return the `private_key` field, this field is the only way to find out whether it was previously set.
tokenTtl?	string	no	Specifies the duration for which App Check tokens exchanged from DeviceCheck tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

getGet a deviceCheckConfig

Argument	Type	Required	Description
identifier	string	yes	The name of the deviceCheckConfig

updateUpdate deviceCheckConfig attributes

syncSync deviceCheckConfig state from GCP

batch_getbatch get

Resources

state(infinite)— An app's DeviceCheck configuration object. This configuration is used by Exch...

@swamp/gcp/firebaseappcheck/apps-playintegrityconfigv2026.04.23.1apps_playintegrityconfig.ts

Global Arguments

Argument	Type	Required	Description
accountDetails?	object	no	A settings object specifying account requirements for Android devices running your app. These settings correspond to requirements on the [account details field](https://developer.android.com/google/play/integrity/verdicts#account-details-field) obtained from the Play Integrity API. See the [default responses table](https://developer.android.com/google/play/integrity/setup#default) for a quick summary. The default values for these settings work for most apps, and are recommended.
appIntegrity?	object	no	A settings object specifying application integrity requirements for Android devices running your app. These settings correspond to requirements on the [application integrity field](https://developer.android.com/google/play/integrity/verdicts#application-integrity-field) obtained from the Play Integrity API. See the [default responses table](https://developer.android.com/google/play/integrity/setup#default) for a quick summary. The default values for these settings work for most apps, and are
deviceIntegrity?	object	no	A settings object specifying device integrity requirements for Android devices running your app. These settings correspond to requirements on the [device integrity field](https://developer.android.com/google/play/integrity/verdicts#device-integrity-field) obtained from the Play Integrity API. See the [default responses table](https://developer.android.com/google/play/integrity/setup#default) for a quick summary. Warning: There are also [conditional](https://developer.android.com/google/play/
name?	string	no	Required. The relative resource name of the Play Integrity configuration object, in the format: ` projects/{project_number}/apps/{app_id}/playIntegrityConfig `
tokenTtl?	string	no	Specifies the duration for which App Check tokens exchanged from Play Integrity tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

getGet a playIntegrityConfig

Argument	Type	Required	Description
identifier	string	yes	The name of the playIntegrityConfig

updateUpdate playIntegrityConfig attributes

syncSync playIntegrityConfig state from GCP

batch_getbatch get

Resources

state(infinite)— An app's Play Integrity configuration object. This configuration controls cer...

@swamp/gcp/firebaseappcheck/apps-recaptchaenterpriseconfigv2026.04.23.1apps_recaptchaenterpriseconfig.ts

Global Arguments

Argument	Type	Required	Description
name?	string	no	Required. The relative resource name of the reCAPTCHA Enterprise configuration object, in the format: ` projects/{project_number}/apps/{app_id}/recaptchaEnterpriseConfig `
riskAnalysis?	object	no	A settings object specifying risk tolerance and requirements for your application. These settings correspond to requirements on the [`riskAnalysis`](https://cloud.google.com/recaptcha/docs/interpret-assessment-website#interpret_assessment) tuple in the assessment obtained from reCAPTCHA Enterprise. The default values for these settings work for most apps, and are recommended.
siteKey?	string	no	The score-based site key [created in reCAPTCHA Enterprise](https://cloud.google.com/recaptcha-enterprise/docs/create-key#creating_a_site_key) used to [invoke reCAPTCHA and generate the reCAPTCHA tokens](https://cloud.google.com/recaptcha-enterprise/docs/instrument-web-pages) for your application. Important: This is not the `site_secret` (as it is in reCAPTCHA v3), but rather your score-based reCAPTCHA Enterprise site key.
tokenTtl?	string	no	Specifies the duration for which App Check tokens exchanged from reCAPTCHA Enterprise tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

getGet a recaptchaEnterpriseConfig

Argument	Type	Required	Description
identifier	string	yes	The name of the recaptchaEnterpriseConfig

updateUpdate recaptchaEnterpriseConfig attributes

syncSync recaptchaEnterpriseConfig state from GCP

batch_getbatch get

Resources

state(infinite)— An app's reCAPTCHA Enterprise configuration object. This configuration is use...

@swamp/gcp/firebaseappcheck/apps-recaptchav3configv2026.04.23.1apps_recaptchav3config.ts

Global Arguments

Argument	Type	Required	Description
minValidScore?	number	no	Specifies a minimum score required for a reCAPTCHA token to be considered valid. If its score is greater than or equal to this value, it will be accepted; otherwise, it will be rejected. The value must be between 0.0 and 1.0. The default value is 0.5.
name?	string	no	Required. The relative resource name of the reCAPTCHA v3 configuration object, in the format: ` projects/{project_number}/apps/{app_id}/recaptchaV3Config `
siteSecret?	string	no	Required. Input only. The site secret used to identify your service for reCAPTCHA v3 verification. For security reasons, this field will never be populated in any response.
siteSecretSet?	boolean	no	Output only. Whether the `site_secret` field was previously set. Since we will never return the `site_secret` field, this field is the only way to find out whether it was previously set.
tokenTtl?	string	no	Specifies the duration for which App Check tokens exchanged from reCAPTCHA tokens will be valid. If unset, a default value of 1 day is assumed. Must be between 30 minutes and 7 days, inclusive.

getGet a recaptchaV3Config

Argument	Type	Required	Description
identifier	string	yes	The name of the recaptchaV3Config

updateUpdate recaptchaV3Config attributes

syncSync recaptchaV3Config state from GCP

batch_getbatch get

Resources

state(infinite)— An app's reCAPTCHA v3 configuration object. This configuration is used by Exc...

@swamp/gcp/firebaseappcheck/apps-safetynetconfigv2026.04.23.1apps_safetynetconfig.ts

Global Arguments

Argument	Type	Required	Description
name?	string	no	Required. The relative resource name of the SafetyNet configuration object, in the format: ` projects/{project_number}/apps/{app_id}/safetyNetConfig `
tokenTtl?	string	no	Specifies the duration for which App Check tokens exchanged from SafetyNet tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

getGet a safetyNetConfig

Argument	Type	Required	Description
identifier	string	yes	The name of the safetyNetConfig

updateUpdate safetyNetConfig attributes

syncSync safetyNetConfig state from GCP

batch_getbatch get

Resources

state(infinite)— An app's SafetyNet configuration object. This configuration controls certain ...

@swamp/gcp/firebaseappcheck/jwksv2026.04.23.1jwks.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)

getGet a jwks

Argument	Type	Required	Description
identifier	string	yes	The name of the jwks

syncSync jwks state from GCP

Resources

state(infinite)— The currently active set of public keys that can be used to verify App Check ...

@swamp/gcp/firebaseappcheck/servicesv2026.04.23.1services.ts

Global Arguments

Argument	Type	Required	Description
enforcementMode?	enum	no	Required. The App Check enforcement mode for this service.
etag?	string	no	Optional. This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding. This etag is strongly validated as defined by RFC 7232.
name?	string	no	Required. The relative resource name of the service configuration object, in the format: ` projects/{project_number}/services/{service_id} ` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore) * `oauth2.googleapis.com` (Google Identity for iOS)
replayProtection?	enum	no	Optional. The replay protection enforcement mode for this service. Note that this field cannot be set to a level higher than the overall App Check enforcement mode. For example, if the overall App Check enforcement mode is set to `UNENFORCED`, this field cannot be set to `ENFORCED`. In order to enforce replay protection, you must first enforce App Check. An HTTP 400 error will be returned in this case. By default, this field is set to `OFF`. Setting this field to `UNENFORCED` or `ENFORCED` is co
updateTime?	string	no	Output only. Timestamp when this service configuration object was most recently updated.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

getGet a services

Argument	Type	Required	Description
identifier	string	yes	The name of the services

updateUpdate services attributes

syncSync services state from GCP

batch_updatebatch update

Argument	Type	Required	Description
requests?	any	no
updateMask?	any	no

Resources

state(infinite)— The enforcement configuration for a Firebase service supported by App Check.

@swamp/gcp/firebaseappcheck/services-resourcepoliciesv2026.04.23.1services_resourcepolicies.ts

Global Arguments

Argument	Type	Required	Description
enforcementMode?	enum	no	Required. The App Check enforcement mode for this resource. This will override the App Check overall EnforcementMode setting on the service.
name?	string	no	Required. Identifier. The relative name of the resource policy object, in the format: ` projects/{project_number}/services/{service_id}/resourcePolicies/{resource_policy_id} ` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `oauth2.googleapis.com` (Google Identity for iOS) `resource_policy_id` is a system-generated UID.
targetResource?	string	no	Required. Service specific name of the resource object to which this policy applies, in the format: * iOS OAuth clients (Google Identity for iOS): `//oauth2.googleapis.com/projects/{project_number}/oauthClients/{oauth_client_id}` Note that the resource must belong to the service specified in the `name` and be from the same project as this policy, but the resource is allowed to be missing at the time of creation of this policy; in that case, we make a best-effort attempt at respecting this po
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

createCreate a resourcePolicies

getGet a resourcePolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the resourcePolicies

updateUpdate resourcePolicies attributes

deleteDelete the resourcePolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the resourcePolicies

syncSync resourcePolicies state from GCP

batch_updatebatch update

Argument	Type	Required	Description
requests?	any	no
updateMask?	any	no

Resources

state(infinite)— App Check enforcement policy for a specific resource of a Google service supp...

@swamp/gcp/firebaseappcheck

Repository

Platforms

Labels

Contents

Quality score

Install

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Release Notes

Release Notes

Release Notes

Release Notes

@swamp/gcp/firebaseappcheck

Repository

Platforms

Labels

Contents

Quality score

Install

Models10

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Global Arguments

Resources

Previous Versions5

Release Notes

Release Notes

Release Notes

Release Notes