How do I use the Google Search Console API?

Q: How do I use the Google Search Console API?

Set up a Cloud project, enable the API, authorise with OAuth, then query performance data, URL inspection and sitemaps. Here are the steps and the quotas.

Create a project in Google Cloud console, enable the Google Search Console API, create OAuth 2.0 credentials, and sign in with a Google account that has access to the property. You can then send requests to four resources: Search Analytics for clicks, impressions, CTR and position; URL Inspection for index status; Sitemaps; and Sites. API keys alone do not work: every call needs an OAuth token, and quotas cap how much you can ask for.

What the API covers, and what it does not

Resource	Methods	Use it for
Search Analytics	`query`	Performance rows by query, page, country, device, search appearance, date or hour
URL Inspection	`index.inspect`	The indexed version of one URL: coverage, last crawl, canonicals
Sitemaps	`list`, `get`, `submit`, `delete`	Managing the sitemaps a property has submitted
Sites	`list`, `get`, `add`, `delete`	The properties in the signed-in account

That is the whole API. Links, Crawl stats, the Page indexing report and the Core Web Vitals report have no endpoint, so they stay inside the Search Console interface. URL Inspection reports what is in Google's index, not a live test of the page.

Set up access

In Google Cloud console, create or choose a project.
Enable the Google Search Console API for that project.
Configure the OAuth consent screen and create an OAuth client ID.
Request a scope: https://www.googleapis.com/auth/webmasters.readonly to read, or https://www.googleapis.com/auth/webmasters to also submit or delete sitemaps.
Sign in with an account that has permission on the property. Reading performance data needs at least read access; the API sees exactly what that account sees.

Your first Search Analytics query

POST https://www.googleapis.com/webmasters/v3/sites/sc-domain%3Aexample.com/searchAnalytics/query
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/json

{
  "startDate": "2026-09-01",
  "endDate": "2026-09-30",
  "dimensions": ["query", "page"],
  "type": "web",
  "rowLimit": 25000,
  "startRow": 0
}

The site goes in the path, URL-encoded: sc-domain:example.com for a Domain property, or the exact prefix with its trailing slash, such as https://www.example.com/, for a URL-prefix property. The fields that matter most:

Dates are inclusive and in Pacific Time.
type is web by default; image, video, news, googleNews and discover are the others. Each needs its own request.
Filters go in dimensionFilterGroups, with operators from equals and contains to includingRegex and excludingRegex (RE2 syntax).
rowLimit runs from 1 to 25,000 (default 1,000); startRow pages through the rest.
dataState is final by default; all adds fresh, unfinished days and hourly_all works with the hour dimension.

Each row returns keys, clicks, impressions, ctr (0 to 1) and position, sorted by clicks unless you group by date.

The limits that shape your code

50,000 rows per day per search type. Page through with startRow in steps of 25,000 and stop at an empty response. To get the most, query one day at a time.
Load quota. Grouping or filtering by both page and query is the most expensive request, and long date ranges cost more than short ones. Exceed the short-term quota and Google asks you to wait 15 minutes.
Request rates. 1,200 queries per minute per site and per user; 40,000 per minute and 30,000,000 per day per project.
URL Inspection quota. 2,000 inspections per day and 600 per minute for each property.
16 months of history, and data is typically available two to three days after the day ends.
Rows do not add up to totals. Rare queries are left out of query-level rows, and grouping by page counts impressions differently from grouping by property, so read totals from a request without the query dimension.

Common mistakes

Using http:// when the property is https://, or leaving off the trailing slash, gives a permission error even when the account has access.
Asking for a URL outside the property in URL Inspection is rejected: the URL must sit under the siteUrl you pass.
A month grouped by query and page in one call returns only the top rows. Daily requests return more.

How AutoPSEO helps

If you would rather not maintain OAuth and pagination, AutoPSEO connects through Google sign-in and exposes the same data through its own REST API at /v1 (with an OpenAPI 3.1 document) and an MCP server, authorised by an API key from Account → API keys. Read-only keys are available, the search analytics endpoint returns up to 5,000 rows per call, and the app's URL Inspection tools keep count of Google's 2,000-a-day quota for you. See MCP and API keys. To keep data past 16 months without writing a pipeline, see how long Search Console keeps data.

Sources: Google's API reference, Search Analytics query method, usage limits, getting all your data and authorisation guide.