What GBP Sandbox replicates

The Google Business Profile API is federated across nine hosts. We replicate the four your integration actually calls, byte-for-byte — and we tell you exactly where that stops, so nothing surprises you in week two.

17 methods replicated 9 on the roadmap 7 out of scope

Hosts

Replicated hosts all collapse onto api.gbpsandbox.com — same paths, same versions, same query parameters. The rest keep their Google host, and must keep their Google credential with it.

Google hostServiceStatusNotes
mybusinessaccountmanagement.googleapis.com Account Management v1 Replicated
mybusinessbusinessinformation.googleapis.com Business Information v1 Replicated
businessprofileperformance.googleapis.com Performance v1 Replicated
mybusiness.googleapis.com My Business v4 (legacy) Replicated Reviews only — media and localPosts are on the roadmap.
mybusinessqanda.googleapis.com Q&A v1 Not replicated Discontinued by Google in November 2025.
mybusinessnotifications.googleapis.com Notifications v1 Not replicated Pub/Sub notification settings — no Google Cloud Pub/Sub in the sandbox.
mybusinessverifications.googleapis.com Verifications v1 Not replicated Verification is a human process on Google's side; sandbox locations are verified by definition.
mybusinessplaceactions.googleapis.com Place Actions v1 Not replicated
mybusinesslodging.googleapis.com Lodging v1 Not replicated

Pick the auth header by destination host, never by which token is loaded

If your client keeps one “current access token” and you point some hosts at the sandbox, a sandbox token can end up in an Authorization header sent to Google — on every cron cycle, in their logs. Select the credential from the URL you are about to call:

const isSandbox = root.startsWith("https://api.gbpsandbox.com");
headers.Authorization = isSandbox
  ? `Bearer ${GBP_SANDBOX_TOKEN}`
  : `Bearer ${googleAccessToken}`;

And skip or stub the senders for non-replicated services in sandbox mode — they have nothing to talk to here.

Account Management v1

MethodHTTPPathStatusNotes
accounts.list GET /v1/accounts Replicated
accounts.create POST /v1/accounts Replicated
accounts.get GET /v1/accounts/* Replicated
accounts.patch PATCH /v1/accounts/* Replicated
accounts.admins.list GET /v1/accounts/*/admins Out of scope The sandbox has no multi-admin model; use workspace members instead.
accounts.invitations.list GET /v1/accounts/*/invitations Out of scope
locations.transfer POST /v1/locations/*:transfer Out of scope

Business Information v1

MethodHTTPPathStatusNotes
accounts.locations.list GET /v1/accounts/*/locations Replicated readMask required, pageToken/nextPageToken pagination.
accounts.locations.create POST /v1/accounts/*/locations Replicated
locations.get GET /v1/locations/* Replicated
locations.patch PATCH /v1/locations/* Replicated updateMask driven.
locations.getAttributes GET /v1/locations/*/attributes Replicated
locations.updateAttributes PATCH /v1/locations/*/attributes Replicated
categories.list GET /v1/categories Replicated
locations.delete DELETE /v1/locations/* Roadmap
attributes.list GET /v1/attributes Roadmap Attribute metadata by category/country.
categories.batchGet GET /v1/categories:batchGet Roadmap
googleLocations.search POST /v1/googleLocations:search Out of scope Searches Google's real place index — nothing to replicate.
chains.search GET /v1/chains:search Out of scope
locations.getGoogleUpdated GET /v1/locations/*:getGoogleUpdated Out of scope Models Google-side edits to a real listing.

Performance v1

MethodHTTPPathStatusNotes
locations.fetchMultiDailyMetricsTimeSeries GET /v1/locations/*:fetchMultiDailyMetricsTimeSeries Replicated
locations.getDailyMetricsTimeSeries GET /v1/locations/*:getDailyMetricsTimeSeries Replicated
locations.searchkeywords.impressions.monthly.list GET /v1/locations/*/searchkeywords/impressions/monthly Roadmap

My Business v4 (legacy)

MethodHTTPPathStatusNotes
accounts.locations.reviews.list GET /v4/accounts/*/locations/*/reviews Replicated pageSize max 50.
accounts.locations.reviews.get GET /v4/accounts/*/locations/*/reviews/* Replicated
accounts.locations.reviews.updateReply PUT /v4/accounts/*/locations/*/reviews/*/reply Replicated
accounts.locations.reviews.deleteReply DELETE /v4/accounts/*/locations/*/reviews/*/reply Replicated
accounts.locations.localPosts.list GET /v4/accounts/*/locations/*/localPosts Roadmap
accounts.locations.localPosts.create POST /v4/accounts/*/locations/*/localPosts Roadmap
accounts.locations.media.list GET /v4/accounts/*/locations/*/media Roadmap
accounts.locations.media.create POST /v4/accounts/*/locations/*/media Roadmap
accounts.locations.reportInsights POST /v4/accounts/*/locations:reportInsights Out of scope Superseded by the Performance API, which is replicated.
accounts.locations.batchGetReviews POST /v4/accounts/*/locations:batchGetReviews Roadmap

Ask the API instead of reading this page

Call an unreplicated method and the sandbox says so in-band, with Google's own canonical status — not a 404 you can't tell from a wrong resource id.

$ curl https://api.gbpsandbox.com/v4/accounts/1/locations/2/localPosts

{
  "error": {
    "code": 501,
    "status": "UNIMPLEMENTED",
    "message": "GBP Sandbox does not replicate 'accounts.locations.localPosts.list' yet…"
  }
}

The same manifest is machine-readable at GET /control/v1/coverage, so an agent wiring your integration can check compatibility before it writes a line.

Start free — no credit card

Missing an endpoint you need? Tell us — the roadmap is built from these requests.