Updated Oct 2026

Google Business Profile API for reviews

Read and reply to Google reviews from your code. Skip the access queue.

The Google Business Profile API is Google’s official, free API for managing Business Profiles, including reading every review and publishing replies for locations you own or manage. Access is not automatic: you apply with a Google Cloud project, and until Google approves it your quota is 0 queries per minute. With Prisma you skip that application: Prisma uses its own Google Cloud project, so you only connect a location by OAuth and call one API.

Get API key

2 locations free. No card required.

How the official Google Business Profile API works

The Google Business Profile API is not a single API. It is a family of services (Business Information, Account Management, Notifications, Verifications, Performance and others) plus the legacy Google My Business API v4, which still hosts the review endpoints. If you are searching for the Google My Business API, it is the same product under its old name: see our Google My Business API page for what changed.

Who can use it

Only accounts that manage the profile. Every call runs with an OAuth 2.0 token from a Google account that is an owner or manager of the location. Both the business.manage and the legacy plus.business.manage scope are accepted. There is no API key mode and no way to query a competitor’s reviews.

Getting access: the Basic API Access application

Google’s prerequisites, as published today:

1. Create a project in Google Cloud Console and note its project number.
2. Manage a Business Profile that has been verified and active for 60+ days, and the business must have a website.
3. Submit the GBP API contact form and choose “Application for Basic API Access”, using an email that is listed as owner or manager on that profile.
4. Wait for a follow-up email. Google does not publish a review time.
5. Check your quota in Cloud Console: 0 QPM means not approved, 300 QPM means approved. Then enable the Business Profile APIs for the project.

Our step-by-step access guide walks through each form field.

The review endpoints

Reviews live under the v4 path https://mybusiness.googleapis.com/v4/:

A raw call looks like this:

curl "https://mybusiness.googleapis.com/v4/accounts/123/locations/456/reviews?pageSize=50&orderBy=updateTime%20desc" \
  -H "Authorization: Bearer $GOOGLE_OAUTH_ACCESS_TOKEN"

Results can be ordered by updateTime desc (default), rating or rating desc. Star ratings come back as an enum (ONE to FIVE), not a number.

Quotas and pricing

Google says the API is available to registered users at no charge. The constraint is quota: 300 QPM by default per API, and a hard limit of 10 edits per minute per Business Profile that cannot be increased. Requests over the limit return HTTP 429 (RESOURCE_EXHAUSTED). More on how the 300 QPM quota behaves in production.

What the Google Business Profile API doesn’t tell you

The documentation is accurate. It just leaves out what breaks once you ship.

Approval is a gate, not a formality. You need a profile that has existed and been verified for 60+ days, with a website. A new SaaS without its own long-lived profile can get stuck before writing a single line of code. If you are rejected, Google only asks you to check the requirements and reapply.

The quota is per project, not per customer. If you build a product on top of the API, every customer shares your 300 QPM. A sync job for 500 locations plus a reply burst from support can hit 429s on a Monday morning.

OAuth is the real work. You need a consent screen, token refresh, revoked-access handling and a mapping between Google accounts, accounts/{id} and locations/{id}. One customer often has locations spread across several Google accounts.

Reviews are still on v4. Most of the platform moved to the newer v1 services; reviews did not. Your code mixes v1 (locations, accounts) and v4 (reviews) URLs and resource names. Google’s deprecation schedule does not list reviews today, but it is the part of the API most likely to move next.

New reviews are not pushed to you by default. Real-time alerts need the Notifications API with Cloud Pub/Sub (NEW_REVIEW, UPDATED_REVIEW). That is another Google Cloud product to set up, secure and monitor.

Replies need Google Search or Maps enabled. For Google Workspace organizations, an administrator must have Google Search and/or Google Maps enabled before replies work. Support tickets will tell you “the API returns an error” without that context.

Read and reply to Google Business Profile reviews with Prisma

Prisma wraps the Google Business Profile API (and Trustpilot, App Store and Google Play) behind one key and one JSON format. You connect each location once by OAuth, with the same owner or manager role Google requires. We run the Google Cloud project, the token refresh and the quota handling.

1. List reviews for a location

curl "https://api.prismareviews.com/v1/reviews?location_id=loc_8f2a&platform=google&since=2026-10-01" \
  -H "Authorization: Bearer $PRISMA_API_KEY"

{
  "data": [
    {
      "id": "rev_01HF3K",
      "platform": "google",
      "location_id": "loc_8f2a",
      "rating": 2,
      "text": "Waited 40 minutes for a table we had booked.",
      "author": "Laura M.",
      "created_at": "2026-10-14T19:02:11Z",
      "reply": null,
      "url": "https://maps.google.com/?cid=12709349212736455432"
    }
  ]
}

2. Reply to it (Node.js)

const res = await fetch("https://api.prismareviews.com/v1/reviews/rev_01HF3K/reply", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.PRISMA_API_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({ text: "Sorry about the wait, Laura. We've changed how we hold booked tables." })
});
console.log(res.status);

3. Same thing in Python

import os, requests

headers = {"Authorization": f"Bearer {os.environ['PRISMA_API_KEY']}"}
reviews = requests.get(
    "https://api.prismareviews.com/v1/reviews",
    params={"platform": "google", "since": "2026-10-01"},
    headers=headers,
).json()["data"]

for r in reviews:
    if r["rating"] <= 2 and r["reply"] is None:
        requests.post(
            f"https://api.prismareviews.com/v1/reviews/{r['id']}/reply",
            json={"text": "Thanks for the feedback. Our manager will contact you today."},
            headers=headers,
        )

Ratings come back as integers 1 to 5. Pagination, token refresh and 429 retries happen on our side. Subscribe to the review.created, review.updated and reply.published webhooks instead of running Pub/Sub. Full endpoint list in the API reference, and a deeper walkthrough on how to reply to Google reviews via API.

Official Google Business Profile API vs Prisma

When to stay with the official API: you manage a handful of your own locations, already have an approved project and only need Google. It’s free and you control everything.

When Prisma makes sense: you need to ship this week, you serve many customers’ locations, or you also need Trustpilot, App Store or Google Play reviews in the same format. See pricing per connected location.

FAQ

Is the Google Business Profile API free?

Yes. Google states the API is available to registered users at no charge. What it costs you is the approval wait, the OAuth and sync engineering, and living within a 300 QPM default quota.

How do I get access to the Google Business Profile API?

Create a Google Cloud project, then submit the “Application for Basic API Access” form with your project number. The email must be an owner or manager of a Business Profile verified and active for 60+ days, and the business needs a website. Your quota stays at 0 QPM until you’re approved.

What is the default quota of the Google Business Profile API?

300 queries per minute once approved, plus a hard limit of 10 edits per minute per Business Profile. Requests above the limit return HTTP 429.

Can I reply to Google reviews with the API?

Yes. updateReply creates or updates the owner reply (up to 4,096 bytes) and deleteReply removes it. Both need the business.manage scope. With Prisma it’s one POST /v1/reviews/{id}/reply.

Can I read reviews of businesses I don’t manage?

No. The Business Profile API only covers locations your Google account owns or manages, and Prisma follows the same rule. For public data on other places, Places API returns at most 5 reviews per place: compare both routes on our Google Reviews API and Google Maps Reviews API (Places) pages.

Do I need an API key for the Google Business Profile API?

Google’s API uses OAuth 2.0 access tokens, not an API key. Prisma gives you a single API key and handles the OAuth tokens for every connected location.