Setup for Full Access

This page describes the basic steps necessary to set up your local environment to experiment with Timeseries Insights API using the curl command.

This is a guide to set up a project with the Timeseries Insights DataSet Owner role (roles/timeseriesinsights.datasetsOwner), which allows you to create and delete datasets.

Before you begin

Install the Google Cloud CLI.
Configure the gcloud CLI to use your federated identity.

For more information, see Sign in to the gcloud CLI with your federated identity.
To initialize the gcloud CLI, run the following command:
```
gcloud init
```
Create or select a Google Cloud project.
Roles required to select or create a project
- Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
- Create a Google Cloud project:
```
gcloud projects create PROJECT_ID
```
  Replace PROJECT_ID with a name for the Google Cloud project you are creating.
- Select the Google Cloud project that you created:
```
gcloud config set project PROJECT_ID
```
  Replace PROJECT_ID with your Google Cloud project name.
Enable the Timeseries Insights API:

Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.
```
gcloud services enable timeseriesinsights.googleapis.com
```

Set up authentication:
1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator). Learn how to grant roles.
2. Create the service account:
```
gcloud iam service-accounts create SERVICE_ACCOUNT_NAME
```
  Replace SERVICE_ACCOUNT_NAME with a name for the service account.
3. Grant the roles/timeseriesinsights.datasetsOwner IAM role to the service account:
```
gcloud projects add-iam-policy-binding PROJECT_ID --member="serviceAccount:SERVICE_ACCOUNT_NAME@PROJECT_ID." --role=roles/timeseriesinsights.datasetsOwner
```
  Replace the following:
  - SERVICE_ACCOUNT_NAME: the name of the service account
  - PROJECT_ID: the project ID where you created the service account
  Note: The --role flag affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.
4. Grant the required role to the principal that will create the access tokens for the service account.
```
gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_NAME@PROJECT_ID. --member="principal://iam.googleapis.com/locations/global/workforcePools/POOL_ID/subject/SUBJECT_ID" --role=roles/iam.serviceAccountTokenCreator
```
  Replace the following:
  - SERVICE_ACCOUNT_NAME: the name of the service account.
  - PROJECT_ID: the project ID where you created the service account.
  - POOL_ID: a workforce identity pool ID.
  - SUBJECT_ID: a subject ID; typically, the identifier for a user in a workforce identity pool. For details, see Represent workforce pool users in IAM policies.

Test with curl

Define a convenient shell alias for calling Google REST APIs:

alias gcurl='curl -H "Authorization: Bearer $(gcloud auth print-access-token --impersonate-service-account=SERVICE_ACCOUNT_EMAIL)" -H "Content-Type: application/json"'

Set an environment variable PROJECT_ID with the identifier of your project:
```
PROJECT_ID="my-project-id"
```
List the enabled APIs and services in this project:
```
gcurl "https://timeseriesinsights.googleapis.com/v1/projects/${PROJECT_ID}/datasets"
```
If you do not see an error, then your setup is successful.

Next steps

Follow Tutorial to learn about the API.