Google Business Profile API Access, local posts, reviews and quotas in 2026

How to get Google Business Profile API access

Unlike most Google APIs, you cannot just enable this one. Google reviews every project first, and the requirements are specific (prerequisites):

• You manage a Business Profile that has been verified and active for 60 days or more. It can be your own office or a client’s.
• The profile lists a website representing the business. Google recommends the profile be complete and current, which speeds up review.
• You apply from an email that is an owner or manager of that profile.

1. Create a project in the Google Cloud console and copy its project number from the Project info card.
2. Submit the GBP API contact form, choosing “Application for Basic API Access”, with your project number.
3. Check the result in the console. Google sends a follow-up email, but the quota tells you sooner: 0 QPM for the Business Profile APIs means not approved, 300 QPM means approved. If it is 0, do not request a quota increase; apply for access.
4. Enable the APIs (basic setup). The Google My Business API only appears in the console after approval.
5. Create an OAuth client ID and request the https://www.googleapis.com/auth/business.manage scope from a user who owns or manages the locations.

If your users sign in with Google Workspace accounts, Business Profile must be turned on for them in the Workspace admin console, or every call fails with 403 PERMISSION_DENIED.

Which Business Profile APIs are still live in 2026?

Google started splitting the old Google My Business API into separate APIs in 2021, and tutorials from different years point at different hosts. This is the current state, from Google’s deprecation schedule and changelog:

In practice: use the v1 APIs to find accounts and locations, and v4 to post and handle reviews. A v4 resource path combines both IDs: accounts/123456789/locations/222222222.

Find your account and location IDs

# Accounts
curl https://mybusinessaccountmanagement.googleapis.com/v1/accounts \
  -H "Authorization: Bearer ACCESS_TOKEN"
# -> {"accounts": [{"name": "accounts/123456789", ...}]}

# Locations (readMask is required)
curl "https://mybusinessbusinessinformation.googleapis.com/v1/accounts/123456789/locations?readMask=name,title&pageSize=100" \
  -H "Authorization: Bearer ACCESS_TOKEN"
# -> {"locations": [{"name": "locations/222222222", "title": "Main Street Bakery"}]}

readMask is required on locations.list; leave it out and the call fails. Pages hold up to 100 locations.

Create local posts with the API

Posts are localPosts on the v4 API. Each has a topicType: STANDARD (an update), EVENT, OFFER or ALERT. The media array only takes a sourceUrl, so the photo has to be at a public URL Google can fetch (LocalPost reference).

Update with a call-to-action button

curl -X POST \
  "https://mybusiness.googleapis.com/v4/accounts/123456789/locations/222222222/localPosts" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "languageCode": "en-US",
    "topicType": "STANDARD",
    "summary": "Pumpkin bread is back from today.",
    "media": [{"mediaFormat": "PHOTO", "sourceUrl": "https://cdn.example.com/pumpkin.jpg"}],
    "callToAction": {"actionType": "ORDER", "url": "https://example.com/order"}
  }'
# -> the LocalPost, with "state" and a "searchUrl" to the live post

The button label comes from actionType: BOOK, ORDER, SHOP, LEARN_MORE, SIGN_UP or CALL (posts guide). CALL dials the number on the listing. The old GET_OFFER action is deprecated; create an OFFER post instead.

Event post

{
  "languageCode": "en-US",
  "topicType": "EVENT",
  "summary": "Free tasting all afternoon.",
  "event": {
    "title": "Autumn tasting day",
    "schedule": {
      "startDate": {"year": 2026, "month": 10, "day": 17},
      "startTime": {"hours": 14, "minutes": 0},
      "endDate": {"year": 2026, "month": 10, "day": 17},
      "endTime": {"hours": 18, "minutes": 0}
    }
  }
}

Since April 2026 an event post can repeat: set recurrenceInfo on the event with a daily or weekly pattern.

Offer post

{
  "languageCode": "en-US",
  "topicType": "OFFER",
  "summary": "Two croissants for the price of one.",
  "event": {
    "title": "Weekend 2-for-1",
    "schedule": {
      "startDate": {"year": 2026, "month": 10, "day": 3},
      "endDate": {"year": 2026, "month": 10, "day": 4}
    }
  },
  "offer": {
    "couponCode": "BOGO-CROISSANT",
    "redeemOnlineUrl": "https://example.com/order",
    "termsConditions": "One per customer."
  }
}

Edit and delete

# Edit only the summary
curl -X PATCH \
  "https://mybusiness.googleapis.com/v4/accounts/123456789/locations/222222222/localPosts/POST_ID?updateMask=summary" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"summary": "Pumpkin bread is back, until Sunday."}'

DELETE on the same path removes the post. After creation, check state: PROCESSING, LIVE, or REJECTED for a content policy violation. A live post has a searchUrl you can share. Product posts cannot be created through the API.

Reviews and review replies

Reviews also live on v4 and only work for verified locations (reviews guide):

# List reviews (max 50 per page)
curl "https://mybusiness.googleapis.com/v4/accounts/123456789/locations/222222222/reviews?pageSize=50&orderBy=updateTime%20desc" \
  -H "Authorization: Bearer ACCESS_TOKEN"

# Reply (creates or replaces the owner reply)
curl -X PUT \
  "https://mybusiness.googleapis.com/v4/accounts/123456789/locations/222222222/reviews/REVIEW_ID/reply" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"comment": "Thanks Jane, see you next weekend!"}'

• List returns up to 50 reviews per page, plus averageRating and totalReviewCount. locations:batchGetReviews reads several locations in one call.
• Reply is a PUT that creates the owner reply or replaces the existing one. The comment is limited to 4,096 bytes.
• Moderation: replies are reviewed. Since 2026 each reply exposes reviewReplyState (PENDING, APPROVED or REJECTED) and, when rejected, a policyViolation explaining why (Review resource).
• Delete with DELETE .../reply. You can remove your reply, never the customer’s review or its rating.

Google Business Profile API in Python

Google publishes client libraries, but the v4 endpoints are easy to call directly. This script finds unanswered four- and five-star reviews and thanks each reviewer, with the backoff Google recommends for 429:

import random
import time
import requests

TOKEN = "ACCESS_TOKEN"            # business.manage scope
LOCATION = "accounts/123456789/locations/222222222"
V4 = "https://mybusiness.googleapis.com/v4"
H = {"Authorization": f"Bearer {TOKEN}"}


def call(method, url, **kw):
    # Exponential backoff with jitter on 429, as Google recommends
    for attempt in range(5):
        r = requests.request(method, url, headers=H, **kw)
        if r.status_code != 429:
            r.raise_for_status()
            return r.json()
        time.sleep(random.uniform(0, 2 ** attempt))
    r.raise_for_status()


def unanswered_reviews():
    page, token = [], None
    while True:
        params = {"pageSize": 50}
        if token:
            params["pageToken"] = token
        data = call("GET", f"{V4}/{LOCATION}/reviews", params=params)
        page += [r for r in data.get("reviews", []) if "reviewReply" not in r]
        token = data.get("nextPageToken")
        if not token:
            return page


for review in unanswered_reviews():
    if review["starRating"] in ("FOUR", "FIVE"):
        name = review["reviewer"]["displayName"].split()[0]
        reply = call("PUT", f"{V4}/{review['name']}/reply",
                     json={"comment": f"Thank you, {name}!"})
        print(review["name"], reply.get("reviewReplyState"))

For negative reviews, queue a draft for a person to approve rather than auto-replying.

Quotas and limits

300 QPM averages 5 requests per second. Google’s advice is to spread calls evenly through the day, cache data that rarely changes, and subscribe to Pub/Sub notifications for new reviews instead of polling every location.

Common Google Business Profile API errors

The shortcut: posts and reviews without the access application

If Google is one channel among several, the slow part is the approval, not the code. Upload-Post’s Google Business Profile API already has access, so you connect the Google account once and publish right away. The offer post at the top of this page is one request. An event post that also goes to Facebook:

curl -X POST https://api.upload-post.com/api/upload_text \
  -H "Authorization: Apikey YOUR_KEY" \
  -F "user=my-bakery" \
  -F "platform[]=google_business" \
  -F "platform[]=facebook" \
  -F "title=Free tasting all afternoon." \
  -F "gbp_location_id=accounts/123456789/locations/222222222" \
  -F "gbp_topic_type=EVENT" \
  -F "gbp_event_title=Autumn tasting day" \
  -F "gbp_event_start_date=2026-10-17" \
  -F "gbp_event_start_time=14:00" \
  -F "gbp_event_end_date=2026-10-17" \
  -F "gbp_event_end_time=18:00" \
  -F "gbp_cta_type=LEARN_MORE" \
  -F "gbp_cta_url=https://example.com/tasting"

GET /api/uploadposts/google-business/locations lists the location IDs for gbp_location_id; if the account has exactly one location it is used automatically. Other options in the docs:

• All three post types: gbp_topic_type STANDARD, EVENT or OFFER, with the event dates and times, gbp_coupon_code, gbp_redeem_url and gbp_terms.
• Buttons: gbp_cta_type BOOK, ORDER, SHOP, LEARN_MORE, SIGN_UP or CALL, with gbp_cta_url. An unknown type is rejected instead of posting without a button.
• Photos to the gallery: gbp_post_type=MEDIA sends the photo to the listing’s Media/Gallery tab instead of creating an Update, filed under a category such as EXTERIOR or FOOD_AND_DRINK.
• Scheduling: scheduled_date with a timezone, up to 365 days ahead, or add_to_queue=true.
• Reviews: list reviews, reply, delete a reply and batch-read several locations.
• Analytics: Google Business Profile metrics from the same analytics endpoint as the other platforms.

Replying to a review, for example:

# Reply to a review through Upload-Post
curl -X PUT https://api.upload-post.com/api/uploadposts/google-business/reviews/reply \
  -H "Authorization: Apikey YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user": "my-bakery",
    "review_name": "accounts/123456789/locations/222222222/reviews/AbcDef",
    "comment": "Thanks Jane, see you next weekend!"
  }'

The Google Business Profile MCP server gives Claude, ChatGPT and Cursor the same tools, so an assistant can draft and post review replies for you to check.

The Free plan is free forever with no card: 10 uploads a month and 2 profiles, with Google Business Profile and API access included. Paid plans with unlimited uploads start at $24 a month ($16 billed annually). Compare options in the social media API overview.

Frequently asked questions

How do I get access to the Google Business Profile API?

Create a Google Cloud project, note its project number, and submit the GBP API contact form choosing “Application for Basic API Access”. Google requires that you manage a Business Profile that has been verified and active for 60 days or more, with a website listed on it, and that you apply from an email that is an owner or manager of that profile. Google emails you after the review.

How do I know if my Google Business Profile API access was approved?

Look at the Business Profile API quotas for your project in the Google Cloud console. A quota of 0 queries per minute means you are not approved yet; 300 QPM means you are. Do not request a quota increase while it is 0; apply for basic access instead.

Is the Google My Business API deprecated?

Not all of it. Google split most features into newer v1 APIs (Account Management, Business Information, Performance and others) and retired some pieces, such as the Q&A API on 3 November 2025. But the v4 Google My Business API is still where local posts, reviews, media and food menus live, and Google shipped new review and post features in v4.9 during 2026.

Can I create Google Business Profile posts through the API?

Yes. POST to https://mybusiness.googleapis.com/v4/accounts/{accountId}/locations/{locationId}/localPosts with a topicType of STANDARD, EVENT or OFFER, a summary, optional photo and an optional callToAction. Product posts cannot be created through the API.

What call-to-action buttons can a Google post have?

BOOK, ORDER, SHOP, LEARN_MORE, SIGN_UP and CALL. Every type except CALL takes a URL; CALL uses the phone number on the listing.

Can I reply to Google reviews with the API?

Yes, on verified locations. PUT to .../reviews/{reviewId}/reply with a comment of up to 4,096 bytes; it creates the reply or updates the existing one. Replies are moderated: reviewReplyState shows PENDING, APPROVED or REJECTED, and a rejected reply includes the policy violation. You cannot delete a customer’s review or change its rating.

What are the Google Business Profile API quotas?

The default is 300 queries per minute for each Business Profile API. The Business Information API also caps location creation at 300 per day, location updates at 10,000 per day, and edits at 10 per minute per Business Profile, which cannot be increased. Going over returns 429 Too Many Requests.

Is there a sandbox for the Google Business Profile API?

No. Google’s setup guide says there is no sandbox environment. Use the validateOnly parameter where it is available to check a request without changing data, and test against a real location you control.

Which OAuth scope does the Google Business Profile API use?

https://www.googleapis.com/auth/business.manage. The older https://www.googleapis.com/auth/plus.business.manage is still accepted on v4 endpoints such as reviews.

Can I schedule Google Business Profile posts with the API?

There is no publish-at field on localPosts: the post goes live when you create it. Since April 2026 you can make an event post recur with RecurrenceInfo, but a one-off post at a future time needs your own scheduler, or a service such as Upload-Post, which takes a scheduled_date up to 365 days ahead.