Roles or permissions needed for API Service Graph connector for Apigee XThere are two ways to assign the required permissions to the service account. 1. Using predefined role(s): In this approach, the service account can be assigned the predefined Apigee Read-only Admin role. This role has all the permissions needed by different data sources of the connector. Additionally, if you wish to fetch data from the three optional GCP data sources (GCP Organization, GCP Folder and GCP Project), the service account also needs to be assigned the Organization Viewer and the Folder Viewer roles. 2. Assigning individual permissions: Alternatively, if you would like to assign the exact permissions to the service account, the following ones should be granted: apigee.apiproducts.getapigee.apiproducts.listapigee.apps.listapigee.deployments.listapigee.developers.listapigee.envgroupattachments.listapigee.envgroups.listapigee.environments.getStatsapigee.environments.listapigee.organizations.getapigee.organizations.listapigee.proxies.getapigee.proxies.listapigee.proxyrevisions.getapigee.targetservers.get Additionally, if you wish to fetch data from the three optional GCP data sources (GCP Organization, GCP Folder and GCP Project), the following permissions also need to be assigned: resourcemanager.folders.getresourcemanager.folders.listresourcemanager.organizations.getresourcemanager.projects.getresourcemanager.projects.list