@@ -0,0 +1,123 @@
+//! Read applied quota values from the Cloud Quotas API.
+
+use crate::gcp::{
+    api_client::{GcpClientBase, GcpServiceConfig},
+    GcpClientConfig,
+};
+use alien_client_core::Result;
+use reqwest::{Client, Method};
+use serde::{Deserialize, Serialize};
+use std::fmt::Debug;
+
+#[cfg(feature = "test-utils")]
+use mockall::automock;
+
+#[derive(Debug)]
+pub struct CloudQuotasServiceConfig;
+
+impl GcpServiceConfig for CloudQuotasServiceConfig {
+    fn base_url(&self) -> &'static str {
+        "https://cloudquotas.googleapis.com/v1"
+    }
+    fn default_audience(&self) -> &'static str {
+        "https://cloudquotas.googleapis.com/"
+    }
+    fn service_name(&self) -> &'static str {
+        "Cloud Quotas"
+    }
+    fn service_key(&self) -> &'static str {
+        "cloudquotas"
+    }
+}
+
+#[cfg_attr(feature = "test-utils", automock)]
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+pub trait CloudQuotasApi: Send + Sync + Debug {
+    /// Get an applied quota, including its dimension-specific values.
+    async fn get_quota_info(&self, service: &str, quota_id: &str) -> Result<QuotaInfo>;
+}
+
+/// Cloud Quotas client restricted to reads in the configured target project.
+#[derive(Debug)]
+pub struct CloudQuotasClient {
+    base: GcpClientBase,
+    project_id: String,
+}
+
+impl CloudQuotasClient {
+    pub fn new(client: Client, config: GcpClientConfig) -> Self {
+        Self {
+            project_id: config.project_id.clone(),
+            base: GcpClientBase::new(client, config, Box::new(CloudQuotasServiceConfig)),
+        }
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+impl CloudQuotasApi for CloudQuotasClient {
+    /// https://cloud.google.com/docs/quotas/reference/rest/v1/projects.locations.services.quotaInfos/get
+    async fn get_quota_info(&self, service: &str, quota_id: &str) -> Result<QuotaInfo> {
+        let path = format!(
+            "projects/{}/locations/global/services/{}/quotaInfos/{}",
+            self.project_id,
+            urlencoding::encode(service),
+            urlencoding::encode(quota_id),
+        );
+        self.base
+            .execute_request(Method::GET, &path, None, Option::<()>::None, quota_id)
+            .await
+    }
+}
+
+/// Applied quota metadata. This API does not report current usage.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuotaInfo {
+    /// Provider quota identifier.
+    pub quota_id: String,
+    /// Provider metric identifier.
+    pub metric: String,
+    /// Dimension keys; empty for project-wide quotas.
+    #[serde(default)]
+    pub dimensions: Vec<String>,
+    /// Applied values for dimension groups.
+    pub dimensions_infos: Option<Vec<DimensionsInfo>>,
+}
+
+/// Applied value for one dimension group.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DimensionsInfo {
+    /// Applied quota, distinct from the catalog default.
+    pub details: Option<QuotaDetails>,
+}
+
+/// Applied int64 quota value encoded as a decimal string.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuotaDetails {
+    /// Missing or invalid values must not be treated as zero.
+    pub value: Option<String>,
+}
+
+impl QuotaInfo {
+    /// Only a single dimensionless project-wide value is safe to use here.
+    pub fn project_limit(&self) -> Option<f64> {
+        if !self.dimensions.is_empty() {
+            return None;
+        }
+        let [info] = self.dimensions_infos.as_deref()? else {
+            return None;
+        };
+        let value = info
+            .details
+            .as_ref()?
+            .value
+            .as_deref()?
+            .parse::<u64>()
+            .ok()?;
+        Some(value as f64)
+    }
+}
@@ -70,6 +70,12 @@ impl GcpServiceConfig for ComputeServiceConfig {
 #[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
 pub trait ComputeApi: Send + Sync + Debug {
+    /// Reads applied regional quota limits and provider-counted usage.
+    async fn get_region_quotas(&self, region: String) -> Result<QuotaCollection>;
+
+    /// Reads project quotas, including CPUs across all regions when present.
+    async fn get_project_quotas(&self) -> Result<QuotaCollection>;
+
     // --- Zone Operations ---
 
     /// Lists zones in the project.
@@ -717,6 +723,20 @@ impl ComputeClient {
 #[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
 impl ComputeApi for ComputeClient {
+    async fn get_region_quotas(&self, region: String) -> Result<QuotaCollection> {
+        let path = format!("projects/{}/regions/{region}", self.project_id);
+        self.base
+            .execute_request(Method::GET, &path, None, Option::<()>::None, "region")
+            .await
+    }
+
+    async fn get_project_quotas(&self) -> Result<QuotaCollection> {
+        let path = format!("projects/{}", self.project_id);
+        self.base
+            .execute_request(Method::GET, &path, None, Option::<()>::None, "project")
+            .await
+    }
+
     // --- Zone Operations ---
 
     async fn list_zones(&self, filter: Option<String>) -> Result<ZoneList> {
@@ -6817,3 +6837,23 @@ mod tests {
         );
     }
 }
+
+/// Quota fields shared by Compute regions.get and projects.get.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuotaCollection {
+    /// Absent quota data is distinct from zero usage.
+    pub quotas: Option<Vec<ComputeQuota>>,
+}
+
+/// Applied quota value and usage reported directly by Compute Engine.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ComputeQuota {
+    /// Provider metric identity, such as N2_CPUS.
+    pub metric: String,
+    /// Applied limit; absence must not become a catalog default.
+    pub limit: Option<f64>,
+    /// Current provider-counted usage.
+    pub usage: Option<f64>,
+}
@@ -68,6 +68,13 @@ pub trait IamApi: Send + Sync + Debug {
 
     async fn get_service_account(&self, service_account_name: String) -> Result<ServiceAccount>;
 
+    /// Read one page of account metadata in the configured target project.
+    async fn list_service_accounts(
+        &self,
+        page_size: Option<i32>,
+        page_token: Option<String>,
+    ) -> Result<ListServiceAccountsResponse>;
+
     async fn patch_service_account(
         &self,
         service_account_name: String,
@@ -214,6 +221,32 @@ impl IamApi for IamClient {
             .await
     }
 
+    /// Lists service accounts without reading their IAM policies or credentials.
+    /// https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/list
+    async fn list_service_accounts(
+        &self,
+        page_size: Option<i32>,
+        page_token: Option<String>,
+    ) -> Result<ListServiceAccountsResponse> {
+        let path = format!("projects/{}/serviceAccounts", self.project_id);
+        let mut query_params = Vec::new();
+        if let Some(size) = page_size {
+            query_params.push(("pageSize", size.to_string()));
+        }
+        if let Some(token) = page_token {
+            query_params.push(("pageToken", token));
+        }
+        self.base
+            .execute_request(
+                Method::GET,
+                &path,
+                Some(query_params).filter(|params| !params.is_empty()),
+                Option::<()>::None,
+                "serviceAccounts",
+            )
+            .await
+    }
+
     /// Updates (patches) a service account.
     /// See: https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/patch
     async fn patch_service_account(
@@ -517,6 +550,17 @@ pub struct ServiceAccount {
     pub etag: Option<String>,
 }
 
+/// One page of service-account metadata. Empty protobuf JSON lists can be absent.
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct ListServiceAccountsResponse {
+    /// Accounts returned on this page; callers must follow the continuation token.
+    #[serde(default)]
+    pub accounts: Vec<ServiceAccount>,
+    /// Opaque cursor for the next page, absent on the last page.
+    pub next_page_token: Option<String>,
+}
+
 /// Request message for creating a service account.
 #[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
 #[serde(rename_all = "snake_case")]
 
@@ -2,6 +2,7 @@ pub mod agent_platform;
 pub mod api_client;
 pub mod artifactregistry;
 pub mod cloud_kms;
+pub mod cloud_quotas;
 pub mod cloud_sql;
 pub mod cloudasset;
 pub mod cloudbuild;
@@ -20,6 +21,7 @@ pub mod pubsub;
 pub mod resource_manager;
 pub mod secret_manager;
 pub mod service_usage;
+pub mod service_usage_quotas;
 
 use alien_client_core::{ErrorData, Result};
 use alien_error::{AlienError, Context, IntoAlienError};
 
@@ -0,0 +1,114 @@
+//! Read applied quota values from the Service Usage quota API.
+
+use crate::gcp::{
+    api_client::{GcpClientBase, GcpServiceConfig},
+    GcpClientConfig,
+};
+use alien_client_core::Result;
+use reqwest::{Client, Method};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use std::fmt::Debug;
+
+#[cfg(feature = "test-utils")]
+use mockall::automock;
+
+#[derive(Debug)]
+pub struct ServiceUsageQuotasServiceConfig;
+
+impl GcpServiceConfig for ServiceUsageQuotasServiceConfig {
+    fn base_url(&self) -> &'static str {
+        "https://serviceusage.googleapis.com/v1beta1"
+    }
+    fn default_audience(&self) -> &'static str {
+        "https://serviceusage.googleapis.com/"
+    }
+    fn service_name(&self) -> &'static str {
+        "Service Usage quota"
+    }
+    fn service_key(&self) -> &'static str {
+        "serviceusage"
+    }
+}
+
+#[cfg_attr(feature = "test-utils", automock)]
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+pub trait ServiceUsageQuotasApi: Send + Sync + Debug {
+    /// Get an applied quota, including its dimension-specific values.
+    async fn get_quota_metric(&self, service: &str, metric: &str) -> Result<QuotaMetric>;
+}
+
+/// Service Usage quota client restricted to reads in the configured target project.
+#[derive(Debug)]
+pub struct ServiceUsageQuotasClient {
+    base: GcpClientBase,
+    project_id: String,
+}
+
+impl ServiceUsageQuotasClient {
+    pub fn new(client: Client, config: GcpClientConfig) -> Self {
+        Self {
+            project_id: config.project_id.clone(),
+            base: GcpClientBase::new(client, config, Box::new(ServiceUsageQuotasServiceConfig)),
+        }
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+impl ServiceUsageQuotasApi for ServiceUsageQuotasClient {
+    /// https://cloud.google.com/service-usage/docs/reference/rest/v1beta1/services.consumerQuotaMetrics/get
+    async fn get_quota_metric(&self, service: &str, metric: &str) -> Result<QuotaMetric> {
+        let path = format!(
+            "projects/{}/services/{}/consumerQuotaMetrics/{}",
+            self.project_id,
+            urlencoding::encode(service),
+            urlencoding::encode(metric),
+        );
+        self.base
+            .execute_request(
+                Method::GET,
+                &path,
+                Some(vec![("view", "FULL".into())]),
+                Option::<()>::None,
+                metric,
+            )
+            .await
+    }
+}
+
+/// A quota metric and its applied limits from Service Usage.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuotaMetric {
+    /// Fully qualified metric resource name.
+    pub name: String,
+    /// Provider metric identifier.
+    pub metric: String,
+    /// Applied limits; missing values are not a zero limit.
+    pub consumer_quota_limits: Option<Vec<ConsumerQuotaLimit>>,
+}
+
+/// A limit for one quota unit.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ConsumerQuotaLimit {
+    /// Metric whose limit this describes.
+    pub metric: String,
+    /// Provider unit, e.g. one per project.
+    pub unit: String,
+    /// Applied values grouped by dimensions.
+    pub quota_buckets: Option<Vec<QuotaBucket>>,
+}
+
+/// Applied quota for a dimension group. Catalog defaults are intentionally omitted.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuotaBucket {
+    /// Dimension filters, empty for a project-wide quota.
+    #[serde(default)]
+    pub dimensions: BTreeMap<String, String>,
+    /// Applied int64 value, encoded as a decimal string by the provider.
+    pub effective_limit: Option<String>,
+}
@@ -1,4 +1,6 @@
 pub mod gcp;
+pub use gcp::cloud_quotas::{CloudQuotasApi, CloudQuotasClient};
+pub use gcp::service_usage_quotas::{ServiceUsageQuotasApi, ServiceUsageQuotasClient};
 pub use gcp::*;
 
 // Re-export commonly used types for convenience