CreateTenant APIs request and response mapping
Supported in:
This guide details the request and response mapping specifications and property parity analysis for migrating from the Legacy Backstory Partner API (CreateCustomer) to the modern Chronicle API (CreateTenant).
Protocol and mapping overview
| Feature | Legacy API (CreateCustomer) |
Modern Chronicle API (CreateTenant) |
|---|---|---|
| HTTP method | POST |
POST |
| Permissions | Partner token or legacy API keys | chronicle.googleapis.com/tenants.create |
Request payload field-by-field parity
The legacy call provisioned a new customer organization under a partner. The modern Chronicle API provisions a tenant resource under a parent instance using the CreateTenantRequest payload.
Legacy field (CreateCustomerRequest) |
Modern field (CreateTenantRequest) |
Field type | Parity and migration notes |
|---|---|---|---|
| — | parent (in HTTP path) |
string |
Google Cloud scoping context: In the legacy API, the target partner was authenticated globally without a resource hierarchy path. In the modern API, the request scopes tenant creation under the parental instance resource path: projects/{project}/locations/{location}/instances/{instance}. |
customer_name |
tenant.display_name |
string |
Parity mapped: Renamed from customer_name to display_name. Represents the human-readable display name of the customer/tenant organization. |
customer_code |
tenant.customer_code |
string |
Parity mapped: Alphanumeric customer identifier code (for example, a 3-5 character customer acronym or ID). |
customer_subdomains |
tenant.frontend_path_configs[].frontend_path |
repeated string $\rightarrow$ repeated FrontendPathConfig |
Parity mapped, consolidated: In the legacy API, customer_subdomains specified subdomains used to access Backstory (<subdomain>.backstory.chronicle.security). In the modern API, this is structured under frontend_path_configs, where each entry maps a frontend_path to its corresponding workforce pool provider. |
provider_id |
tenant.frontend_path_configs[].workforce_pool_provider_id |
string $\rightarrow$ repeated FrontendPathConfig |
Parity mapped, structured: In the legacy API, provider_id was a standalone workforce pool provider ID for BYOID. In the modern API, it is configured within each FrontendPathConfig entry as workforce_pool_provider_id (format: locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}). |
gcp_project |
tenant.tenant_gcp_project |
string |
Parity mapped: Customer's Bring Your Own Project (BYOP) Google Cloud project. In the legacy API, this was passed as a raw project ID string. In the modern API, it must be passed as a canonical resource name: projects/{project_id} or projects/{project_number}. |
retention_duration |
tenant.retention_duration |
RetentionDuration (enum) |
Parity mapped: Customer contract data retention duration. Legacy enum values (ONE_YEAR = 1, SIX_MONTHS = 2) map directly to modern values (ONE_YEAR = 1, SIX_MONTHS = 3). The modern API also supports extended durations (EIGHTEEN_MONTHS, TWO_YEARS, THREE_YEARS, FOUR_YEARS). Note that retention_duration is a required field in CreateTenant. |
auth_version |
tenant.auth_method |
AuthVersion $\rightarrow$ AuthMethod (enum) |
Restructured: In the legacy API, authentication was selected using auth_version (AUTH_VERSION_1 to AUTH_VERSION_4). In the modern API, authentication is configured using the auth_method enum (WORKFORCE_IDENTITY_FEDERATION or CLOUD_IDENTITY). |
sso_config |
— | bytes |
Retired: In the legacy API, SAML SSO was provisioned by uploading raw XML configuration bytes. In the modern Chronicle API, identity federation is managed natively using Workforce Identity Federation or Cloud Identity. |
| — | tenant.billing_account |
string |
New required field: Specifies the Cloud Billing account resource path associated with the customer contract (format: billingAccounts/{billing_account_id}). |
| — | tenant.provisioning_flow |
ProvisioningFlow (enum) |
New optional field: Specifies the provisioning flow variant (BACKSTORY_API_PARITY for Backstory API parity migration, or TENANT_ATTRIBUTION for tenant attribution). |
| — | tenant.name |
string |
Read-only / identifier: The server-assigned canonical resource path for the tenant: projects/{project}/locations/{location}/instances/{instance}/tenants/{tenant_id}. |
| — | tenant.state |
State (enum) |
Output only: Current lifecycle state of the tenant (for example, CREATING, ACTIVE, DELETING). |
Response payload field-by-field parity
Both endpoints return a long-running operation (google.longrunning.Operation). The legacy operation resolved to a Customer resource containing provisioned credentials and forwarders, while the modern operation returns a Tenant resource alongside workflow metadata in TenantMetadata.
Legacy field (Customer message) |
Modern field (Tenant message) |
Field type | Parity and migration notes |
|---|---|---|---|
id / customer_id |
name |
string |
Parity mapped: In the legacy API, the customer was identified by a UUID string (id) and raw binary identifier (customer_id). In the modern API, the tenant is identified by its canonical Google Cloud resource name: projects/{project}/locations/{location}/instances/{instance}/tenants/{tenant_id}. |
customer_name |
display_name |
string |
Parity mapped: User-visible display name of the tenant organization. |
customer_code |
customer_code |
string |
Parity mapped: Customer acronym/code identifier. |
customer_subdomains |
frontend_path_configs[].frontend_path |
repeated string $\rightarrow$ repeated FrontendPathConfig |
Parity mapped: Associated frontend paths for accessing the instance. |
provider_id |
frontend_path_configs[].workforce_pool_provider_id |
string $\rightarrow$ repeated FrontendPathConfig |
Parity mapped: Associated workforce pool provider IDs. |
gcp_project_number |
tenant_gcp_project |
uint64 $\rightarrow$ string |
Parity mapped: Bound Google Cloud project path (projects/{project_id} or projects/{project_number}). |
retention_duration |
retention_duration |
string $\rightarrow$ RetentionDuration (enum) |
Parity mapped: Contractually agreed data retention period. |
auth_version |
auth_method |
AuthVersion $\rightarrow$ AuthMethod (enum) |
Parity mapped: Active authentication mechanism for the tenant. |
| — | state |
State (enum) |
New field: Current lifecycle state of the provisioned tenant (ACTIVE, CREATING, DELETING, etc.). |
| — | billing_account |
string |
New field: The Cloud Billing account resource path tied to the tenant contract. |
| — | provisioning_flow |
ProvisioningFlow (enum) |
New field: Identifies the provisioning workflow executed (BACKSTORY_API_PARITY or TENANT_ATTRIBUTION). |
credentials |
— | repeated Credential |
Retired: Legacy API issued client credentials (API keys and tokens). Modern access control is governed by standard Google Cloud IAM roles and service accounts. |
forwarders |
— | repeated string |
Decoupled: Forwarders are managed independently using modern Forwarder Management APIs (/forwarders). |
sso_config |
— | SSOConfig |
Retired: SSO configuration is managed through standard Workforce Identity Federation configurations. |
looker_detail |
— | LookerDetail |
Decoupled: Embedded Looker slot details are managed automatically by Google SecOps platform infrastructure. |
compliance_certifications |
— | repeated ComplianceCertification |
Restructured: In the modern architecture, compliance certifications are configured at the parent instance level (compliance_requirements) rather than per individual tenant. |
Long-running operation metadata parity
The modern API populates google.longrunning.Operation.metadata with TenantMetadata:
Modern field (TenantMetadata) |
Field type | Description |
|---|---|---|
creation_workflow_status |
WorkflowState (enum) |
Execution state of the tenant creation workflow (RUNNING, FINISHED, ERROR, CANCELLED, WAITING, QUEUED, PAUSED, SKIPPED). |
tenant |
string |
Canonical resource path of the tenant being created (projects/{project}/locations/{location}/instances/{instance}/tenants/{tenant_id}). |
Key differences
- Google Cloud resource model integration:
- Tenant creation is scoped under a parent instance resource:
projects/{project}/locations/{location}/instances/{instance}. - Associated projects (
tenant_gcp_project) and billing accounts (billing_account) use standard Google Cloud resource name formats.
- Tenant creation is scoped under a parent instance resource:
- Consolidated frontend path and identity provider configs:
- Rather than separate lists of subdomains and a standalone provider ID, modern
frontend_path_configsexplicitly pairs each frontend URL path with its corresponding Workforce Identity Pool provider.
- Rather than separate lists of subdomains and a standalone provider ID, modern
- Authentication and credential modernization:
- Raw SAML XML (
sso_config) uploads and API-generated legacy credentials (credentials) are replaced by standard Workforce Identity Federation / Cloud Identity integration and Cloud IAM service account authorization.
- Raw SAML XML (
- Billing account linkage:
- Callers must explicitly specify
billing_accountlinked to an active SecOps contract.
- Callers must explicitly specify
- Operation polling and status tracking:
- Both APIs use long-running operations, but the modern API enriches operation progress with
TenantMetadataproviding granular workflow lifecycle states (creation_workflow_status).
- Both APIs use long-running operations, but the modern API enriches operation progress with