Modernizing the Google SecOps Developer Experience: The Shift to the Chronicle API

Authors:

Sukeerth Reddy, Senior Product Manager 

Ronak Gadia, Senior Software Engineer

TL;DR: We are standardizing all Google SecOps programmatic access on the next-generation Chronicle API (chronicle.googleapis.com) and announcing the deprecation of legacy SIEM APIs (Backstory and Ingestion APIs) with end of life on July 20, 2027. This self-service migration comes at no additional cost and with zero service downtime. Check out our Migration Guide to get started.


As cyber threats become increasingly sophisticated, security operations teams rely heavily on automation, real-time telemetry ingestion, and seamless integrations to defend their digital estates. At Google Cloud, our vision for Google Security Operations (SecOps) is built around empowering developers, security engineers, and MSSP partners with an enterprise-grade, highly performant, and developer-friendly ecosystem.

Today, we are excited to highlight a major milestone in our platform evolution: Modernizing the Google SecOps Developer Experience by standardizing all programmatic access on the next-generation Chronicle API (chronicle.googleapis.com).

As part of this transition, we are formally announcing the deprecation timeline for our legacy SIEM APIs—specifically the Backstory API (including the Customer Management API) and the Ingestion API—in favor of our unified, Google Cloud AI native API surface.

Why We Are Modernizing: A Unified Foundation for Agentic SecOps

Google SecOps originally inherited standalone API structures from early architectural generations. Over the past several years, we have completely rebuilt our core infrastructure onto Google Cloud's unified and AI native API architecture.

Moving from legacy API endpoints to the modern Chronicle API is not just an endpoint update—it is the critical foundational upgrade that enables superior reliability, security, compliance, and developer productivity:

• Modern Authentication & Identity: Say goodbye to manually managed API keys and shared credentials. Chronicle API natively integrates with Google Cloud IAM, supporting Application Default Credentials (ADC), keyless Workload Identity Federation, and granular role-based permissions.

• Enterprise Security & Compliance: The new Chronicle API delivers native support for critical enterprise compliance controls, including VPC Service Controls (VPC-SC), Customer-Managed Encryption Keys (CMEK), Data Residency, Access Transparency, and FedRAMP, that couldn’t be supported by Legacy APIs.

• Standardized AIP Design & Ecosystem Tooling: Chronicle API is built according to Google's standard API Improvement Proposals (AIPs), bringing predictable, resource-oriented RESTful design. 

• Extensible Ecosystem: Developers gain out-of-the-box support for Google Cloud Client Libraries, Terraform providers, and OneMCP.

• Enhanced Ingestion Performance: Customers adopting the Chronicle API benefit from a 4x increase in allowable ingestion batch sizes, growing from a 1MB limit to a 4MB capacity.

• Deep Observability & Operations: Integrates natively with Cloud Audit Logs (CAL) and Cloud Monitoring, providing full visibility into API activity, security auditing, and performance telemetry directly within your Google Cloud project.

• Unlocking Agentic Security Operations: By standardizing on modern Google Cloud infrastructure, customer environments are fully prepped to leverage Agentic SecOps capabilities, enabling AI-driven security automation powered by Gemini.
   

Comparing Legacy SIEM APIs vs. Modern Chronicle API
 

Deprecation Schedule & Key Milestones

To ensure a smooth transition, we are providing a 12-month migration window for existing customers and partners. Importantly, this transition is entirely cost-neutral (no additional cost) and will cause zero service downtime for your Google SecOps environment.

• July 20, 2026 – Announcement & Migration Window Launch: Deprecation was formally announced via Mandatory Service Announcements (MSAs), in-product banner, and public documentation. Existing instances continue to operate normally while teams migrate.

• October 26, 2026 – End of Sale: Newly provisioned Google SecOps instances from this date will no longer have access to legacy Backstory or Ingestion APIs. All new automation must use the Chronicle API.

• July 20, 2027 – End of Life (Full Turn-Down): Legacy Backstory API and Ingestion API endpoints will be decommissioned across all existing instances. All calls to legacy endpoints will cease functioning.

Who is in scope of this upgrade?

• This deprecation applies to you only if you have custom integrations or scripts (including SOAR connector, Bindplane) that currently call legacy Backstory API or Ingestion API endpoints. Get started by following the 4 Step Migration Guide below and complete the Migration before July 20, 2027.

• Note that any actions performed in the SecOps UI have already been updated to invoke the new Chronicle API - you don’t need to take any action. 

How to Migrate: A 4-Step Developer Workflow

Migrating your custom automation to the Chronicle API is straightforward:

• Step 1: Audit API Usage
  Audit your environment to identify scripts or integrations invoking backstory.googleapis.com or legacy ingestion endpoints. Google SecOps admins can review API telemetry in the Google SecOps console or Cloud Audit Logs.
   
• Step 2: Enable the Chronicle API in GCP
  In the Google Cloud Console, navigate to your project and enable the Chronicle API (chronicle.googleapis.com). See: Enabling an API in your GCP.
   
• Step 3: Update Authentication & Endpoint URLs
  Transition authentication from static credentials to Application Default Credentials (ADC) or Service Accounts or Workload Identity. See: Authenticate to the Chronicle API.
  Update legacy URLs to regionalized Chronicle API REST endpoints (including strict regionalization endpoints such as chronicle.us.rep.googleapis.com for strict residency requirements). For a comprehensive list of all supported endpoints, see the official reference: Chronicle API Reference: Service Endpoint.
   
• Step 4: Test & Deploy
  Test updated scripts in a non-production environment or staging tenant to verify IAM roles and response mappings before promoting to production.

Resources & Support

We are committed to supporting our community throughout this transition:

• Official Migration Guide: Migrate from Legacy SIEM APIs to Chronicle API

• Legacy to New API Mapping: SIEM API Endpoint Mapping Table

• API Reference: Chronicle API REST Documentation

• Authentication Setup: Authenticate to the Chronicle API

Thank you for being a valued Google SecOps customer as we build a safer, more reliable, and developer-empowered security future together!