Provide an HTTP API on a Compute Engine VM that only in-VPC clients can call and allow clients to obtain the service IP.

The correct approach is to have clients use the VM's internal fully qualified domain name (FQDN) from Compute Engine internal DNS. This ensures that only clients within the same Virtual Private Cloud (VPC) can resolve and access the VM, fulfilling the "in-VPC clients only" requirement. The internal DNS automatically provides the VM's internal IP address, which clients can then use to call the HTTP API. Reserving a static external IP and assigning it to an HTTP(S) load balancer forwarding rule, or creating a Cloud DNS A record pointing to an external IP, would expose the service to the internet, violating the "in-VPC clients only" constraint. While Compute Engine provides internal DNS, it does not offer "API-style internal DNS path names" in the manner described; clients typically use the standard FQDN.