Spaces:
Running
Running
| from __future__ import annotations | |
| from typing import Any, Dict | |
| # Google per-API scope catalog as an in-memory Python data structure. | |
| # Source of truth: app/services/google_scopes_data.py (no JSON files). | |
| # Permission levels: "non-sensitive" | "sensitive" | "restricted". | |
| GOOGLE_APIS: Dict[str, Dict[str, Any]] = { 'maps_static': { 'id': 'maps_static', | |
| 'api': 'Google Maps Static API', | |
| 'version': 'v1', | |
| 'base_url': 'https://maps.googleapis.com/maps/api/staticmap', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'API Key (no OAuth)', | |
| 'scope_required': False, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/maps/documentation/maps-static/overview', | |
| 'info': 'Authenticates with a server-side API key only (optionally URL-signed). No OAuth ' | |
| 'scopes are required.', | |
| 'scopes': [], | |
| 'recommended_combinations': {}, | |
| 'production_notes': { 'key_restriction': 'Restrict the API key by IP address in Google ' | |
| 'Cloud Console > APIs & Services > Credentials.', | |
| 'billing_required': True, | |
| 'signature': 'Use a digital signature (signing secret) when URL ' | |
| 'usage is visible to end users.'}}, | |
| 'places': { 'id': 'places', | |
| 'api': 'Google Places API', | |
| 'version': 'v1', | |
| 'base_url': 'https://places.googleapis.com/v1', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'API Key (no OAuth)', | |
| 'scope_required': False, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/maps/documentation/places/web-service/overview', | |
| 'info': 'Authenticates with an API key. The new Places API also supports OAuth bearer tokens, ' | |
| 'but it is not required and no dedicated user-data scopes exist. API-key ' | |
| 'authentication is the standard path.', | |
| 'scopes': [], | |
| 'recommended_combinations': {}, | |
| 'production_notes': { 'key_restriction': 'Restrict the API key by IP address and allowed ' | |
| 'Google Maps APIs.', | |
| 'billing_required': True, | |
| 'oauth_optional': 'Requests can alternatively carry an OAuth access ' | |
| 'token in the Authorization header, but no user-data ' | |
| 'scopes are defined for Places.'}}, | |
| 'geocoding': { 'id': 'geocoding', | |
| 'api': 'Google Geocoding API', | |
| 'version': 'v1', | |
| 'base_url': 'https://maps.googleapis.com/maps/api/geocode', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'API Key (no OAuth)', | |
| 'scope_required': False, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/maps/documentation/geocoding/overview', | |
| 'info': 'Authenticates with an API key. No OAuth scopes are required.', | |
| 'scopes': [], | |
| 'recommended_combinations': {}, | |
| 'production_notes': { 'key_restriction': 'Restrict the API key by IP address and allowed ' | |
| 'Google Maps APIs.', | |
| 'billing_required': True}}, | |
| 'gemini': { 'id': 'gemini', | |
| 'api': 'Google Gemini API (public)', | |
| 'version': 'v1beta', | |
| 'base_url': 'https://generativelanguage.googleapis.com/v1beta', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'API Key (no OAuth)', | |
| 'scope_required': False, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://ai.google.dev/gemini-api/docs', | |
| 'info': 'Authenticates with an API key via the X-Goog-Api-Key header or key query parameter. ' | |
| 'No OAuth scopes are required.', | |
| 'scopes': [], | |
| 'recommended_combinations': {}, | |
| 'production_notes': { 'key_restriction': 'Restrict the API key to the Generative Language API ' | |
| 'in Google Cloud Console.', | |
| 'billing_required': False, | |
| 'free_tier': 'The public Gemini API has a free tier; higher quotas ' | |
| 'require billing.'}}, | |
| 'cloud_ai': { 'id': 'cloud_ai', | |
| 'api': 'Google Cloud AI (Vision, Translate)', | |
| 'version': 'v1', | |
| 'base_url': 'https://vision.googleapis.com/v1', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'API Key or Service Account (no user OAuth)', | |
| 'scope_required': False, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://cloud.google.com/docs/authentication', | |
| 'info': 'Vision and Translate use either an API key or a service account for authentication. ' | |
| 'No user OAuth scopes are required. If an end-user OAuth flow is ever used instead, ' | |
| 'the broad cloud-platform scope applies, but it is not needed for the standard ' | |
| 'API-key/service-account path.', | |
| 'scopes': [], | |
| 'recommended_combinations': {}, | |
| 'production_notes': { 'key_restriction': 'Restrict the API key to the Cloud Vision and Cloud ' | |
| 'Translation APIs.', | |
| 'service_account': 'Preferred for server-to-server calls: attach the ' | |
| 'service account to the instance or use an ' | |
| 'ADC-signed token.', | |
| 'billing_required': True}}, | |
| 'cloud_storage': { 'id': 'cloud_storage', | |
| 'api': 'Google Cloud Storage', | |
| 'version': 'v1', | |
| 'base_url': 'https://storage.googleapis.com/storage/v1', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Service Account (no user OAuth)', | |
| 'scope_required': False, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://cloud.google.com/storage/docs/authentication', | |
| 'info': 'Authenticates with a service account (application-default credentials) or a ' | |
| 'signed URL. No user OAuth scopes are required. The legacy devstorage scopes ' | |
| 'exist only for end-user OAuth flows and are not needed here.', | |
| 'scopes': [], | |
| 'recommended_combinations': {}, | |
| 'production_notes': { 'service_account': 'Grant the service account the Storage Object ' | |
| 'Admin / Storage Object Viewer roles on the ' | |
| 'target buckets.', | |
| 'signed_urls': 'Use query-parameter signatures for time-limited ' | |
| 'public download/upload URLs.', | |
| 'billing_required': True}}, | |
| 'oauth_signin': { 'id': 'oauth_signin', | |
| 'api': 'Google OAuth 2.0 Sign-In (Identity / OIDC)', | |
| 'version': 'oidc', | |
| 'base_url': 'https://oauth2.googleapis.com', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (OpenID Connect)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/identity/openid-connect/openid-connect', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. ' | |
| 'Requires only basic OAuth App ' | |
| 'Verification.', | |
| 'sensitive': 'Provides access to specific Google user ' | |
| 'data that users authorize. Requires ' | |
| 'additional OAuth App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification ' | |
| 'and (if stored/transmitted on servers) a ' | |
| 'security assessment.'}, | |
| 'scopes': [ { 'name': 'openid', | |
| 'uri': 'openid', | |
| 'description': 'OpenID Connect authentication; returns the ID token with a ' | |
| 'stable subject identifier (sub).', | |
| 'permission_level': 'non-sensitive', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Core OIDC scope; required to receive an id_token.', | |
| 'least_privilege_recommendation': 'Always request. Keep it combined with ' | |
| 'email and profile for basic identity.'}, | |
| { 'name': 'email', | |
| 'uri': 'https://www.googleapis.com/auth/userinfo.email', | |
| 'description': 'See your primary Google Account email address.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': "Used to read the user's verified primary email address.", | |
| 'least_privilege_recommendation': 'Request only when the app needs the ' | |
| "user's email address for account " | |
| 'mapping.'}, | |
| { 'name': 'profile', | |
| 'uri': 'https://www.googleapis.com/auth/userinfo.profile', | |
| 'description': 'See your personal info, including any personal info you ' | |
| 'have made publicly available.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': "Used to read the user's name, picture, locale and other profile " | |
| 'fields.', | |
| 'least_privilege_recommendation': 'Request only when the app needs profile ' | |
| 'display data.'}, | |
| { 'name': 'userinfo.email', | |
| 'uri': 'https://www.googleapis.com/auth/userinfo.email', | |
| 'description': 'See your primary Google Account email address (legacy ' | |
| 'alias of email).', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Legacy duplicate of the email scope.', | |
| 'least_privilege_recommendation': 'Prefer the openid/email/profile ' | |
| 'combination; avoid requesting the ' | |
| 'legacy alias twice.'}, | |
| { 'name': 'userinfo.profile', | |
| 'uri': 'https://www.googleapis.com/auth/userinfo.profile', | |
| 'description': 'See your personal info (legacy alias of profile).', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Legacy duplicate of the profile scope.', | |
| 'least_privilege_recommendation': 'Prefer the openid/email/profile ' | |
| 'combination; avoid requesting the ' | |
| 'legacy alias twice.'}], | |
| 'recommended_combinations': { 'default': [ 'openid', | |
| 'https://www.googleapis.com/auth/userinfo.email', | |
| 'https://www.googleapis.com/auth/userinfo.profile']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'None of these scopes are ' | |
| 'sensitive/restricted, so only basic ' | |
| 'OAuth App Verification is needed.', | |
| 'default_scope_request': 'openid email profile'}}, | |
| 'people': { 'id': 'people', | |
| 'api': 'Google People API (Contacts)', | |
| 'version': 'v1', | |
| 'base_url': 'https://people.googleapis.com/v1', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/people/v1/contacts', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data ' | |
| 'that users authorize. Requires additional OAuth ' | |
| 'App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and (if ' | |
| 'stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'contacts.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/contacts.readonly', | |
| 'description': 'Read all of your Google Contacts.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Core read capability for contact automation: list/get contacts, ' | |
| 'contact groups and search.', | |
| 'least_privilege_recommendation': 'Default scope for reading contacts. Upgrade ' | |
| 'to contacts (read/write) only when the app ' | |
| 'must create or modify contacts.'}, | |
| { 'name': 'contacts', | |
| 'uri': 'https://www.googleapis.com/auth/contacts', | |
| 'description': 'Read, write, and manage your contacts.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Read/write access to the user's entire contact list.", | |
| 'least_privilege_recommendation': 'Request only when creating/editing/deleting ' | |
| 'contacts is a hard requirement; otherwise ' | |
| 'stay read-only.'}, | |
| { 'name': 'contacts.other.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/contacts.other.readonly', | |
| 'description': 'Read the contact information of other people that a given ' | |
| 'contact has shared with you.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Access to a contact's 'other contacts' (secondary people).", | |
| 'least_privilege_recommendation': 'Rarely needed; omit unless the app must read ' | |
| "a contact's own address book."}, | |
| { 'name': 'directory.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/directory.readonly', | |
| 'description': 'Read the list of people in your domain (Google Workspace ' | |
| 'directory).', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Company directory access; only meaningful for Google Workspace ' | |
| 'domains.', | |
| 'least_privilege_recommendation': 'Request only for Workspace directory use ' | |
| 'cases; requires a Workspace admin to grant ' | |
| 'access.'}], | |
| 'recommended_combinations': { 'read_only': [ 'https://www.googleapis.com/auth/contacts.readonly'], | |
| 'read_write': ['https://www.googleapis.com/auth/contacts']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'All contacts scopes are RESTRICTED and ' | |
| 'require restricted-scope OAuth App ' | |
| 'Verification and a security assessment if ' | |
| 'data is stored/transmitted on servers.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/contacts.readonly'}}, | |
| 'calendar': { 'id': 'calendar', | |
| 'api': 'Google Calendar API', | |
| 'version': 'v3', | |
| 'base_url': 'https://www.googleapis.com/calendar/v3', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/calendar/api/auth', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data ' | |
| 'that users authorize. Requires additional ' | |
| 'OAuth App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and ' | |
| '(if stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'calendar.events', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.events', | |
| 'description': 'See, edit, share, and permanently delete the calendars you can ' | |
| 'access using Google Calendar.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Core read/write for events (create/update/delete events) without ' | |
| 'exposing calendar settings or the full ACL model.', | |
| 'least_privilege_recommendation': 'Default scope for event automation. Prefer ' | |
| 'calendar.events.readonly when the app never ' | |
| 'writes events.'}, | |
| { 'name': 'calendar.events.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.events.readonly', | |
| 'description': 'View events on all your calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to events across all calendars.', | |
| 'least_privilege_recommendation': 'Use for read-only event automation ' | |
| '(scheduling checks, availability).'}, | |
| { 'name': 'calendar.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.readonly', | |
| 'description': 'See and download any calendar you can access using your Google ' | |
| 'Calendar.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to calendars including metadata and events.', | |
| 'least_privilege_recommendation': 'Use when the app needs to read calendar ' | |
| 'metadata and settings, not just events.'}, | |
| { 'name': 'calendar', | |
| 'uri': 'https://www.googleapis.com/auth/calendar', | |
| 'description': 'See, edit, share, and permanently delete the calendars you can ' | |
| 'access using Google Calendar.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Full access to all Calendar functionality including sharing and ' | |
| 'ACLs.', | |
| 'least_privilege_recommendation': 'Avoid. calendar.events + ' | |
| 'calendar.settings.readonly cover most ' | |
| 'automation with a smaller surface.'}, | |
| { 'name': 'calendar.freebusy', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.freebusy', | |
| 'description': 'See free/busy availability for attendees and calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Only returns busy/free blocks, never event details.', | |
| 'least_privilege_recommendation': 'Use for availability checks that must not ' | |
| 'expose event content.'}, | |
| { 'name': 'calendar.settings.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.settings.readonly', | |
| 'description': "See your primary account's Calendar settings.", | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Read-only access to the user's calendar settings (timezone, working " | |
| 'hours).', | |
| 'least_privilege_recommendation': 'Request alongside calendar.events only if ' | |
| 'settings/working-hours are needed.'}, | |
| { 'name': 'calendar.calendarlist.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.calendarlist.readonly', | |
| 'description': 'View calendars you own or subscribe to.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Lists the user's calendar subscriptions and their visibility/color " | |
| 'metadata.', | |
| 'least_privilege_recommendation': 'Use when the app must enumerate subscribed ' | |
| 'calendars without full read/write.'}, | |
| { 'name': 'calendar.calendarlist', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.calendarlist', | |
| 'description': 'See, edit, and delete your Google Calendar lists.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Manage the user's calendar list (add/remove subscribed calendars).", | |
| 'least_privilege_recommendation': 'Request only when the app manages calendar ' | |
| 'subscriptions.'}, | |
| { 'name': 'calendar.calendars.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.calendars.readonly', | |
| 'description': 'View your Calendar events and details.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to calendar metadata (name, description, ' | |
| 'timezone).', | |
| 'least_privilege_recommendation': 'Narrower than calendar.readonly; use when ' | |
| 'only calendar-level metadata is needed.'}, | |
| { 'name': 'calendar.calendars', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.calendars', | |
| 'description': 'View and edit the metadata of your calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write calendar metadata without event or ACL access.', | |
| 'least_privilege_recommendation': 'Request only when the app edits calendar ' | |
| 'metadata.'}, | |
| { 'name': 'calendar.acls.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.acls.readonly', | |
| 'description': 'See who has access to your calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to calendar sharing rules.', | |
| 'least_privilege_recommendation': 'Request only for sharing/visibility ' | |
| 'audits.'}, | |
| { 'name': 'calendar.acls', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.acls', | |
| 'description': 'See, edit, and share your calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write calendar sharing (ACL) rules.', | |
| 'least_privilege_recommendation': 'Request only when the app manages calendar ' | |
| 'sharing.'}, | |
| { 'name': 'calendar.events.owned.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.events.owned.readonly', | |
| 'description': 'See the events you own.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to events the user owns (not events shared with ' | |
| 'them).', | |
| 'least_privilege_recommendation': 'Narrower read option when the app only ' | |
| "needs the user's own events."}, | |
| { 'name': 'calendar.events.owned', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.events.owned', | |
| 'description': 'See, edit, share, and permanently delete the calendars you can ' | |
| 'access using Google Calendar (own events).', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write for events the user owns.', | |
| 'least_privilege_recommendation': 'Use when the app only manages events ' | |
| 'created by the user.'}, | |
| { 'name': 'calendar.app.created', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.app.created', | |
| 'description': 'Create and manage events on secondary calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Creates events in secondary calendars for the app.', | |
| 'least_privilege_recommendation': 'Request only when the app needs its own ' | |
| 'secondary calendar.'}, | |
| { 'name': 'calendar.events.public.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.events.public.readonly', | |
| 'description': 'View public events on all your calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to public events only.', | |
| 'least_privilege_recommendation': 'Use only when the app strictly needs public ' | |
| 'event data.'}, | |
| { 'name': 'calendar.events.freebusy', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.events.freebusy', | |
| 'description': 'View free/busy information for your calendars.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Free/busy only, without event details.', | |
| 'least_privilege_recommendation': 'Similar to calendar.freebusy; use the ' | |
| 'narrower single scope.'}, | |
| { 'name': 'calendar.addons.execute', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.addons.execute', | |
| 'description': 'Run your add-on (Calendar add-on runtime).', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Required to run a Calendar add-on; not needed for server-side ' | |
| 'automation.', | |
| 'least_privilege_recommendation': 'Skip for backend automation.'}, | |
| { 'name': 'calendar.addons.current.event.read', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.addons.current.event.read', | |
| 'description': 'See the event details of the calendar event where the add-on ' | |
| 'is displayed.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Reads the event the add-on card is attached to.', | |
| 'least_privilege_recommendation': 'Skip for backend automation; add-on context ' | |
| 'only.'}, | |
| { 'name': 'calendar.addons.current.event.write', | |
| 'uri': 'https://www.googleapis.com/auth/calendar.addons.current.event.write', | |
| 'description': 'See, edit, share, and permanently delete the event where the ' | |
| 'add-on is displayed.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Writes the event the add-on card is attached to.', | |
| 'least_privilege_recommendation': 'Skip for backend automation; add-on context ' | |
| 'only.'}], | |
| 'recommended_combinations': { 'read_only_events': [ 'https://www.googleapis.com/auth/calendar.events.readonly'], | |
| 'event_crud': [ 'https://www.googleapis.com/auth/calendar.events'], | |
| 'availability_only': [ 'https://www.googleapis.com/auth/calendar.freebusy'], | |
| 'full_calendar': ['https://www.googleapis.com/auth/calendar']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'Most calendar scopes are RESTRICTED and ' | |
| 'require restricted-scope OAuth App ' | |
| 'Verification and a security assessment if ' | |
| 'data is stored/transmitted on servers.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/calendar.events'}}, | |
| 'sheets': { 'id': 'sheets', | |
| 'api': 'Google Sheets API', | |
| 'version': 'v4', | |
| 'base_url': 'https://sheets.googleapis.com/v4', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/workspace/sheets/api/scopes', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data ' | |
| 'that users authorize. Requires additional OAuth ' | |
| 'App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and (if ' | |
| 'stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'drive.file', | |
| 'uri': 'https://www.googleapis.com/auth/drive.file', | |
| 'description': 'See, edit, create, and delete only the specific Google Drive ' | |
| 'files you use with this app.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Per-file access scoped to spreadsheets the user opened/created with ' | |
| "the app. Google's recommended minimal scope for Sheets.", | |
| 'least_privilege_recommendation': 'Default scope for spreadsheet automation. ' | |
| 'Request it before spreadsheets to keep the ' | |
| 'risk surface minimal.'}, | |
| { 'name': 'spreadsheets.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/spreadsheets.readonly', | |
| 'description': 'See all your Google Sheets spreadsheets.', | |
| 'permission_level': 'sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Read-only access to all spreadsheets in the user's Drive.", | |
| 'least_privilege_recommendation': 'Use for read-only spreadsheet automation that ' | |
| 'must address files by URL.'}, | |
| { 'name': 'spreadsheets', | |
| 'uri': 'https://www.googleapis.com/auth/spreadsheets', | |
| 'description': 'See, edit, create, and delete all of your Google Sheets files.', | |
| 'permission_level': 'sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Read/write access to all spreadsheets in the user's Drive.", | |
| 'least_privilege_recommendation': 'Request only when the app must address any ' | |
| 'spreadsheet by URL and drive.file is ' | |
| 'insufficient.'}, | |
| { 'name': 'drive.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.readonly', | |
| 'description': 'See and download all your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Broad read access to the entire Drive, including spreadsheets.', | |
| 'least_privilege_recommendation': 'Avoid unless the app needs other Drive file ' | |
| 'types alongside sheets.'}, | |
| { 'name': 'drive', | |
| 'uri': 'https://www.googleapis.com/auth/drive', | |
| 'description': 'See, edit, create, and delete all of your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Full read/write access to the entire Drive.', | |
| 'least_privilege_recommendation': 'Avoid. Prefer drive.file or spreadsheets.'}], | |
| 'recommended_combinations': { 'per_file_automation': [ 'https://www.googleapis.com/auth/drive.file'], | |
| 'read_only_by_url': [ 'https://www.googleapis.com/auth/spreadsheets.readonly'], | |
| 'read_write_by_url': [ 'https://www.googleapis.com/auth/spreadsheets']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'spreadsheets/spreadsheets.readonly are ' | |
| 'SENSITIVE; drive and drive.readonly are ' | |
| 'RESTRICTED and require restricted-scope ' | |
| 'verification.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/drive.file'}}, | |
| 'youtube': { 'id': 'youtube', | |
| 'api': 'YouTube Data API', | |
| 'version': 'v3', | |
| 'base_url': 'https://www.googleapis.com/youtube/v3', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/youtube/v3/guides/auth', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data ' | |
| 'that users authorize. Requires additional OAuth ' | |
| 'App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and (if ' | |
| 'stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'youtube.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/youtube.readonly', | |
| 'description': 'See a list of your YouTube videos and playlists and related ' | |
| 'information such as view counts, comments, and ratings.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Core read capability for channel/video metadata, playlists, comments ' | |
| 'and search.', | |
| 'least_privilege_recommendation': 'Default scope for read-only YouTube ' | |
| 'automation.'}, | |
| { 'name': 'youtube.upload', | |
| 'uri': 'https://www.googleapis.com/auth/youtube.upload', | |
| 'description': 'Manage your YouTube videos.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Upload videos to the user's channel. No read access to channel data.", | |
| 'least_privilege_recommendation': 'Use for upload pipelines that do not need to ' | |
| 'read channel metadata.'}, | |
| { 'name': 'youtube.force-ssl', | |
| 'uri': 'https://www.googleapis.com/auth/youtube.force-ssl', | |
| 'description': 'See, edit, and permanently delete your YouTube videos, ratings, ' | |
| 'comments and captions.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write for videos, ratings, comments, captions and playlists.', | |
| 'least_privilege_recommendation': 'Request when the app must edit or delete ' | |
| 'content; combine with youtube.upload for ' | |
| 'uploads.'}, | |
| { 'name': 'youtube', | |
| 'uri': 'https://www.googleapis.com/auth/youtube', | |
| 'description': 'Manage your YouTube account.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Full account management, including channel settings.', | |
| 'least_privilege_recommendation': 'Avoid unless account-level management is ' | |
| 'required.'}, | |
| { 'name': 'youtube.channel-memberships.creator', | |
| 'uri': 'https://www.googleapis.com/auth/youtube.channel-memberships.creator', | |
| 'description': 'See a list of your current active channel members, their ' | |
| 'current level, and when they became a member.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to channel membership data.', | |
| 'least_privilege_recommendation': 'Request only for creator membership ' | |
| 'analytics.'}, | |
| { 'name': 'youtubepartner', | |
| 'uri': 'https://www.googleapis.com/auth/youtubepartner', | |
| 'description': 'View and manage your assets and associated content on YouTube.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'YouTube Partner Program asset/content management.', | |
| 'least_privilege_recommendation': 'Request only for partner/MCN integrations.'}, | |
| { 'name': 'youtubepartner-channel-audit', | |
| 'uri': 'https://www.googleapis.com/auth/youtubepartner-channel-audit', | |
| 'description': 'View private information of your YouTube channel relevant ' | |
| 'during the audit process with a YouTube partner.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Channel audit data used by partners.', | |
| 'least_privilege_recommendation': 'Request only for partner audit workflows.'}], | |
| 'recommended_combinations': { 'read_only': [ 'https://www.googleapis.com/auth/youtube.readonly'], | |
| 'upload_only': [ 'https://www.googleapis.com/auth/youtube.upload'], | |
| 'read_write': [ 'https://www.googleapis.com/auth/youtube.force-ssl'], | |
| 'read_write_and_upload': [ 'https://www.googleapis.com/auth/youtube.force-ssl', | |
| 'https://www.googleapis.com/auth/youtube.upload']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'All YouTube scopes are RESTRICTED and ' | |
| 'require restricted-scope OAuth App ' | |
| 'Verification and a security assessment if ' | |
| 'data is stored/transmitted on servers.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/youtube.readonly'}}, | |
| 'drive': { 'id': 'drive', | |
| 'api': 'Google Drive API', | |
| 'version': 'v3', | |
| 'base_url': 'https://www.googleapis.com/drive/v3', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/workspace/drive/api/guides/api-specific-auth', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data that ' | |
| 'users authorize. Requires additional OAuth App ' | |
| 'Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and (if ' | |
| 'stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'drive.file', | |
| 'uri': 'https://www.googleapis.com/auth/drive.file', | |
| 'description': 'See, edit, create, and delete only the specific Google Drive ' | |
| 'files you use with this app.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': "Google's recommended default: per-file access limited to files the app " | |
| 'created or opened.', | |
| 'least_privilege_recommendation': 'Default scope for Drive automation. Upgrade ' | |
| 'only when the app must address arbitrary files ' | |
| 'by ID/URL.'}, | |
| { 'name': 'drive.metadata.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.metadata.readonly', | |
| 'description': 'See information about your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to file metadata (name, mimeType, parents) without ' | |
| 'content.', | |
| 'least_privilege_recommendation': 'Use for indexing/listing that does not need ' | |
| "file content. Google's recommended minimal " | |
| 'metadata scope.'}, | |
| { 'name': 'drive.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.readonly', | |
| 'description': 'See and download all your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to all files and their content.', | |
| 'least_privilege_recommendation': 'Use for read-only automation addressing files ' | |
| 'by ID/URL.'}, | |
| { 'name': 'drive', | |
| 'uri': 'https://www.googleapis.com/auth/drive', | |
| 'description': 'See, edit, create, and delete all of your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Full read/write access to the entire Drive.', | |
| 'least_privilege_recommendation': 'Avoid. Prefer drive.file whenever possible.'}, | |
| { 'name': 'drive.metadata', | |
| 'uri': 'https://www.googleapis.com/auth/drive.metadata', | |
| 'description': 'See, edit, create, and delete only the specific Google Drive ' | |
| 'files you use with this app (metadata only).', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write file metadata only, no content.', | |
| 'least_privilege_recommendation': 'Rarely needed; request only when metadata must ' | |
| 'be modified.'}, | |
| { 'name': 'drive.appdata', | |
| 'uri': 'https://www.googleapis.com/auth/drive.appdata', | |
| 'description': 'View and manage its own configuration data in your Google Drive.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Access only to the app's private appdata folder.", | |
| 'least_privilege_recommendation': 'Request only when using the Drive appdata ' | |
| 'folder for per-user config.'}, | |
| { 'name': 'drive.apps.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.apps.readonly', | |
| 'description': "See and download your application's data using Google Drive.", | |
| 'permission_level': 'sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Read-only access to the app's own data in Drive.", | |
| 'least_privilege_recommendation': 'Request only when the app must access files it ' | |
| 'created in Drive.'}, | |
| { 'name': 'drive.scripts', | |
| 'uri': 'https://www.googleapis.com/auth/drive.scripts', | |
| 'description': 'See, edit, create, and delete your scripts in Google Apps Script.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Access to Apps Script projects.', | |
| 'least_privilege_recommendation': 'Request only for Apps Script management.'}, | |
| { 'name': 'drive.install', | |
| 'uri': 'https://www.googleapis.com/auth/drive.install', | |
| 'description': 'Add or remove yourself as an editor of documents your app opens.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': "Used with the Drive UI 'Open with' flow.", | |
| 'least_privilege_recommendation': 'Request only when integrating with the Drive ' | |
| 'web UI.'}, | |
| { 'name': 'drive.activity', | |
| 'uri': 'https://www.googleapis.com/auth/drive.activity', | |
| 'description': 'View the activity history of your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write visibility into Drive activity history.', | |
| 'least_privilege_recommendation': 'Request only for audit/activity features.'}, | |
| { 'name': 'drive.activity.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.activity.readonly', | |
| 'description': 'View the activity history of your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to Drive activity history.', | |
| 'least_privilege_recommendation': 'Prefer this over drive.activity when no writes ' | |
| 'are needed.'}, | |
| { 'name': 'drive.photos.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.photos.readonly', | |
| 'description': 'View the files and photos in your Google Photos library.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to the Google Photos library.', | |
| 'least_privilege_recommendation': 'Request only for Google Photos integration.'}, | |
| { 'name': 'drive.meet.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.meet.readonly', | |
| 'description': 'See and download all your Google Meet recordings saved to Google ' | |
| 'Drive.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to Meet recordings stored in Drive.', | |
| 'least_privilege_recommendation': 'Request only for Meet recording workflows.'}], | |
| 'recommended_combinations': { 'per_file_automation': [ 'https://www.googleapis.com/auth/drive.file'], | |
| 'metadata_only': [ 'https://www.googleapis.com/auth/drive.metadata.readonly'], | |
| 'read_only_by_id': [ 'https://www.googleapis.com/auth/drive.readonly'], | |
| 'full_drive': ['https://www.googleapis.com/auth/drive']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'drive.file and drive.install are ' | |
| 'NON-SENSITIVE; drive.apps.readonly is ' | |
| 'SENSITIVE; the remaining scopes are ' | |
| 'RESTRICTED and require restricted-scope ' | |
| 'verification.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/drive.file'}}, | |
| 'admin_sdk': { 'id': 'admin_sdk', | |
| 'api': 'Google Workspace Admin SDK (Directory & Reports)', | |
| 'version': 'directory_v1 / reports_v1', | |
| 'base_url': 'https://admin.googleapis.com/admin', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 (typically domain-wide delegation via a service account)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/workspace/admin/directory/v1/guides/authorize', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data ' | |
| 'that users authorize. Requires additional ' | |
| 'OAuth App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and ' | |
| '(if stored/transmitted on servers) a ' | |
| 'security assessment.'}, | |
| 'scopes': [ { 'name': 'admin.directory.user.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.user.readonly', | |
| 'description': 'See information about users on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Core read capability for directory user management.', | |
| 'least_privilege_recommendation': 'Default read scope for user directory ' | |
| 'automation.'}, | |
| { 'name': 'admin.directory.user', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.user', | |
| 'description': 'See, edit, configure, and delete your Google Account.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write user lifecycle management (create, suspend, delete ' | |
| 'users).', | |
| 'least_privilege_recommendation': 'Request only when the app must ' | |
| 'create/update/delete users.'}, | |
| { 'name': 'admin.directory.group.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.group.readonly', | |
| 'description': 'See information about groups on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to group metadata.', | |
| 'least_privilege_recommendation': 'Use for read-only group listing.'}, | |
| { 'name': 'admin.directory.group', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.group', | |
| 'description': 'See, edit, create, and delete all of your Google Group ' | |
| 'subscriptions.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write group management.', | |
| 'least_privilege_recommendation': 'Request only when the app manages groups.'}, | |
| { 'name': 'admin.directory.group.member.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.group.member.readonly', | |
| 'description': 'See information about members of groups on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to group memberships.', | |
| 'least_privilege_recommendation': 'Use for read-only membership listing.'}, | |
| { 'name': 'admin.directory.group.member', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.group.member', | |
| 'description': 'See, edit, and manage membership of groups on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write group membership management.', | |
| 'least_privilege_recommendation': 'Request only when the app adds/removes ' | |
| 'group members.'}, | |
| { 'name': 'admin.directory.device.chromeos.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly', | |
| 'description': 'See information about your ChromeOS devices.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only ChromeOS device inventory.', | |
| 'least_privilege_recommendation': 'Request only for device inventory ' | |
| 'reporting.'}, | |
| { 'name': 'admin.directory.device.chromeos', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.device.chromeos', | |
| 'description': 'See, edit, configure, and delete your ChromeOS devices.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write ChromeOS device management.', | |
| 'least_privilege_recommendation': 'Request only when managing ChromeOS ' | |
| 'devices.'}, | |
| { 'name': 'admin.directory.orgunit.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.orgunit.readonly', | |
| 'description': 'See information about organizational units on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to organizational units.', | |
| 'least_privilege_recommendation': 'Request only for OU-aware reporting.'}, | |
| { 'name': 'admin.directory.orgunit', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.orgunit', | |
| 'description': 'See, edit, and configure organizational units on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write OU management.', | |
| 'least_privilege_recommendation': 'Request only when managing organizational ' | |
| 'units.'}, | |
| { 'name': 'admin.directory.rolemanagement.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly', | |
| 'description': 'See information about roles on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to admin roles.', | |
| 'least_privilege_recommendation': 'Request only for role auditing.'}, | |
| { 'name': 'admin.directory.rolemanagement', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.rolemanagement', | |
| 'description': 'See, edit, and manage admin roles on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write admin role assignments.', | |
| 'least_privilege_recommendation': 'Request only when managing admin roles.'}, | |
| { 'name': 'admin.directory.domain.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.domain.readonly', | |
| 'description': 'See information about domains on your account.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to domain settings.', | |
| 'least_privilege_recommendation': 'Request only when domain metadata is ' | |
| 'needed.'}, | |
| { 'name': 'admin.directory.customer.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.customer.readonly', | |
| 'description': 'See information about your Google Workspace account.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to customer/account settings.', | |
| 'least_privilege_recommendation': 'Request only when account-level metadata ' | |
| 'is needed.'}, | |
| { 'name': 'admin.directory.userschema.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.directory.userschema.readonly', | |
| 'description': 'See information about custom user schemas on your domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to custom schema definitions.', | |
| 'least_privilege_recommendation': 'Request only when reading custom user ' | |
| 'attributes.'}, | |
| { 'name': 'admin.reports.audit.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.reports.audit.readonly', | |
| 'description': 'View audit reports for your Google Workspace domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to admin audit logs.', | |
| 'least_privilege_recommendation': 'Request only for audit/reporting ' | |
| 'features.'}, | |
| { 'name': 'admin.reports.usage.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admin.reports.usage.readonly', | |
| 'description': 'View usage reports for your Google Workspace domain.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access to usage metrics.', | |
| 'least_privilege_recommendation': 'Request only for usage analytics.'}, | |
| { 'name': 'admin.datatransfer', | |
| 'uri': 'https://www.googleapis.com/auth/admin.datatransfer', | |
| 'description': 'Manage the transfer of data between user accounts.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Performs/administers data-transfer requests between users.', | |
| 'least_privilege_recommendation': 'Request only for user data-transfer ' | |
| 'workflows.'}], | |
| 'recommended_combinations': { 'directory_read_users': [ 'https://www.googleapis.com/auth/admin.directory.user.readonly'], | |
| 'directory_full_users': [ 'https://www.googleapis.com/auth/admin.directory.user'], | |
| 'groups_read': [ 'https://www.googleapis.com/auth/admin.directory.group.readonly', | |
| 'https://www.googleapis.com/auth/admin.directory.group.member.readonly'], | |
| 'reports': [ 'https://www.googleapis.com/auth/admin.reports.audit.readonly']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'delegation': 'Admin APIs are normally called with domain-wide ' | |
| 'delegation from a service account using a Workspace ' | |
| 'super-admin account; the OAuth user flow only works ' | |
| 'for users with admin privileges.', | |
| 'verification_requirement': 'All admin.directory and admin.reports ' | |
| 'scopes are RESTRICTED and require ' | |
| 'restricted-scope verification and a ' | |
| 'security assessment.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/admin.directory.user.readonly'}}, | |
| 'bigquery': { 'id': 'bigquery', | |
| 'api': 'Google BigQuery API', | |
| 'version': 'v2', | |
| 'base_url': 'https://bigquery.googleapis.com/bigquery/v2', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 or Service Account (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://cloud.google.com/bigquery/docs/authentication', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data ' | |
| 'that users authorize. Requires additional ' | |
| 'OAuth App Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope verification and ' | |
| '(if stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'bigquery.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/bigquery.readonly', | |
| 'description': 'View your data in Google BigQuery.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'Read-only access to datasets, tables, and query results.', | |
| 'least_privilege_recommendation': 'Default scope for analytics/reporting. ' | |
| 'Upgrade to bigquery only when the app must ' | |
| 'write or manage data.'}, | |
| { 'name': 'bigquery', | |
| 'uri': 'https://www.googleapis.com/auth/bigquery', | |
| 'description': 'View and manage your data in Google BigQuery.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read/write/delete data, datasets and jobs.', | |
| 'least_privilege_recommendation': 'Request only when the app inserts data, ' | |
| 'manages tables/datasets, or runs DDL/DML.'}, | |
| { 'name': 'bigquery.insertdata', | |
| 'uri': 'https://www.googleapis.com/auth/bigquery.insertdata', | |
| 'description': 'Insert data into your Google BigQuery tables.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Insert-only (streaming/bulk insert) without the ability to modify ' | |
| 'schema.', | |
| 'least_privilege_recommendation': 'Use for ingest-only pipelines.'}, | |
| { 'name': 'cloud-platform', | |
| 'uri': 'https://www.googleapis.com/auth/cloud-platform', | |
| 'description': 'See, edit, configure, and delete your Google Cloud data and ' | |
| 'see the email address for your Google Account.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Broad access to all Google Cloud resources for the signed-in user.', | |
| 'least_privilege_recommendation': 'Avoid for user OAuth; use it only as a ' | |
| 'fallback when the app is itself a GCP ' | |
| 'management tool.'}, | |
| { 'name': 'cloud-platform.read-only', | |
| 'uri': 'https://www.googleapis.com/auth/cloud-platform.read-only', | |
| 'description': 'View your data across Google Cloud Platform services.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Read-only access across GCP services.', | |
| 'least_privilege_recommendation': 'Prefer the narrower bigquery.readonly ' | |
| 'scope.'}, | |
| { 'name': 'devstorage.read_only', | |
| 'uri': 'https://www.googleapis.com/auth/devstorage.read_only', | |
| 'description': 'View your data in Google Cloud Storage.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Required to load data directly from files in Cloud Storage into ' | |
| 'BigQuery.', | |
| 'least_privilege_recommendation': 'Request only when jobs load from GCS ' | |
| 'objects.'}, | |
| { 'name': 'drive.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/drive.readonly', | |
| 'description': 'See and download all your Google Drive files.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Required to query external tables that reference Google Drive files ' | |
| '(e.g., Google Sheets).', | |
| 'least_privilege_recommendation': 'Request only when querying Drive-backed ' | |
| 'external tables.'}], | |
| 'recommended_combinations': { 'read_only_analytics': [ 'https://www.googleapis.com/auth/bigquery.readonly'], | |
| 'read_write': ['https://www.googleapis.com/auth/bigquery'], | |
| 'ingest_only': [ 'https://www.googleapis.com/auth/bigquery.insertdata'], | |
| 'load_from_gcs': [ 'https://www.googleapis.com/auth/bigquery', | |
| 'https://www.googleapis.com/auth/devstorage.read_only']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'bigquery* and cloud-platform scopes are ' | |
| 'RESTRICTED and require restricted-scope ' | |
| 'verification and a security assessment.', | |
| 'service_account': 'Server-to-server automation should prefer a ' | |
| 'service account over user OAuth; the same scopes ' | |
| 'are requested during impersonation.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/bigquery.readonly'}}, | |
| 'gmail': { 'id': 'gmail', | |
| 'api': 'Gmail API', | |
| 'version': 'v1', | |
| 'base_url': 'https://gmail.googleapis.com/gmail/v1', | |
| 'batch_endpoint': 'https://gmail.googleapis.com/batch/gmail/v1', | |
| 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/gmail/api/auth/scopes', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' | |
| 'only basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data that ' | |
| 'users authorize. Requires additional OAuth App ' | |
| 'Verification.', | |
| 'restricted': 'Provides wide access to Google user data. ' | |
| 'Requires restricted-scope OAuth App Verification ' | |
| 'and (if data is stored/transmitted on servers) a ' | |
| 'security assessment.'}, | |
| 'scopes': [ { 'name': 'gmail.addons.current.action.compose', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.action.compose', | |
| 'description': 'Manage drafts and send emails when you interact with the add-on.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Only required for Gmail add-on context (cards running inside the Gmail ' | |
| 'UI). Not needed for server-side mailbox automation.', | |
| 'least_privilege_recommendation': 'Skip. Use gmail.compose (server-side) instead; ' | |
| 'this scope only works inside the add-on ' | |
| 'runtime.'}, | |
| { 'name': 'gmail.addons.current.message.action', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.action', | |
| 'description': 'View your email messages when you interact with the add-on.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Add-on UI only. Useless for backend automation.', | |
| 'least_privilege_recommendation': 'Skip. Use gmail.readonly or gmail.metadata ' | |
| 'from a server context.'}, | |
| { 'name': 'gmail.labels', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.labels', | |
| 'description': 'See and edit your email labels.', | |
| 'permission_level': 'non-sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Required only when the app must create/update/delete labels or manage ' | |
| 'label-based inbox organization.', | |
| 'least_privilege_recommendation': 'Request only when label CRUD is needed. If the ' | |
| 'app only reads labels embedded in messages, ' | |
| 'gmail.metadata suffices.'}, | |
| { 'name': 'gmail.addons.current.message.metadata', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.metadata', | |
| 'description': 'View your email message metadata when the add-on is running.', | |
| 'permission_level': 'sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Add-on UI only.', | |
| 'least_privilege_recommendation': 'Skip for server-side automation. Use ' | |
| 'gmail.metadata.'}, | |
| { 'name': 'gmail.addons.current.message.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.readonly', | |
| 'description': 'View your email messages when the add-on is running.', | |
| 'permission_level': 'sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Add-on UI only.', | |
| 'least_privilege_recommendation': 'Skip for server-side automation. Use ' | |
| 'gmail.readonly.'}, | |
| { 'name': 'gmail.send', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.send', | |
| 'description': 'Send email on your behalf.', | |
| 'permission_level': 'sensitive', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Send-only automation (outbound notification engines) that never needs ' | |
| 'to read the mailbox.', | |
| 'least_privilege_recommendation': 'Use when the app sends email but does NOT need ' | |
| 'to read the inbox. Pairs well with a separate ' | |
| 'read scope if inbox reading is also needed.'}, | |
| { 'name': 'gmail.compose', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.compose', | |
| 'description': 'Manage drafts and send emails.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Draft-first workflows (approval flows) plus sending. Does not grant ' | |
| 'read access to the inbox.', | |
| 'least_privilege_recommendation': 'Choose over gmail.send when drafts must be ' | |
| 'managed, but the app never reads inbox ' | |
| 'messages.'}, | |
| { 'name': 'gmail.metadata', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.metadata', | |
| 'description': 'View your email message metadata such as labels and headers, but ' | |
| 'not the email body.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Indexing/analytics that only needs headers and labels without message ' | |
| 'bodies.', | |
| 'least_privilege_recommendation': 'Strongly preferred over gmail.readonly when ' | |
| 'body text is not required. Significantly ' | |
| 'reduces data exposure.'}, | |
| { 'name': 'gmail.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.readonly', | |
| 'description': 'View your email messages and settings.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': False, | |
| 'reason': 'Core read capability for mailbox automation: list/get messages, ' | |
| 'threads, drafts, attachments, labels and settings. Cannot write.', | |
| 'least_privilege_recommendation': 'Use for read-only automation. Combine with ' | |
| 'gmail.modify only if the app must also change ' | |
| 'labels/read state. Do NOT request when ' | |
| 'gmail.metadata satisfies the requirement.'}, | |
| { 'name': 'gmail.modify', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.modify', | |
| 'description': 'Read, compose, and send emails from your Gmail account. This ' | |
| 'scope does not allow immediate, permanent deletion of threads and ' | |
| 'messages, bypassing the trash.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'End-to-end mailbox management: read, send, trash, label, modify read ' | |
| "state, manage drafts/threads. The recommended 'full CRUD' scope " | |
| 'because permanent delete stays behind trash.', | |
| 'least_privilege_recommendation': 'Default scope for complete mailbox automation. ' | |
| 'Prefer over https://mail.google.com/ whenever ' | |
| 'possible; it covers all operations except ' | |
| 'immediate permanent deletion.'}, | |
| { 'name': 'gmail.insert', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.insert', | |
| 'description': 'Add emails into your Gmail mailbox.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Mailbox migration, archiving, or importing historical messages.', | |
| 'least_privilege_recommendation': 'Request only for import/migration flows. ' | |
| 'Combined with gmail.readonly if the app also ' | |
| 'reads existing mail.'}, | |
| { 'name': 'gmail.settings.basic', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.settings.basic', | |
| 'description': 'See, edit, create, or change your email settings and filters in ' | |
| 'Gmail.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Automating mailbox configuration: filters, forwarding addresses, ' | |
| 'vacation responders, IMAP/POP toggles.', | |
| 'least_privilege_recommendation': 'Request only when the app manages mailbox ' | |
| 'settings/filters. Otherwise omit to limit ' | |
| 'scope.'}, | |
| { 'name': 'gmail.settings.sharing', | |
| 'uri': 'https://www.googleapis.com/auth/gmail.settings.sharing', | |
| 'description': 'Manage your sensitive mail settings, including who can manage ' | |
| 'your mail.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Granting/revoking mail delegation (Google Workspace). Operations ' | |
| 'guarded by this scope are administrative and normally use domain-wide ' | |
| 'delegation via a service account.', | |
| 'least_privilege_recommendation': 'Request only for Workspace admin/delegation ' | |
| 'use cases. Requires extra verification; not ' | |
| 'needed for ordinary per-user automation.'}, | |
| { 'name': 'mail.google.com', | |
| 'uri': 'https://mail.google.com/', | |
| 'description': 'Read, compose, send, and permanently delete all your email from ' | |
| 'Gmail.', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'Only needed when the app must permanently delete threads/messages ' | |
| 'immediately, bypassing trash.', | |
| 'least_privilege_recommendation': 'Avoid. Request only when immediate permanent ' | |
| 'deletion is a hard requirement; otherwise ' | |
| 'gmail.modify covers everything else with a ' | |
| 'much smaller risk surface.'}], | |
| 'recommended_combinations': { 'read_only_automation': [ 'https://www.googleapis.com/auth/gmail.readonly'], | |
| 'metadata_only_automation': [ 'https://www.googleapis.com/auth/gmail.metadata'], | |
| 'full_mailbox_crud': [ 'https://www.googleapis.com/auth/gmail.modify', | |
| 'https://www.googleapis.com/auth/gmail.send', | |
| 'https://www.googleapis.com/auth/gmail.settings.basic'], | |
| 'full_mailbox_crud_with_permanent_delete': [ 'https://mail.google.com/', | |
| 'https://www.googleapis.com/auth/gmail.settings.basic'], | |
| 'send_only': ['https://www.googleapis.com/auth/gmail.send']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'verification_requirement': 'RESTRICTED and SENSITIVE scopes require ' | |
| 'Google OAuth App Verification before ' | |
| 'production use. RESTRICTED-scope data stored ' | |
| 'or transmitted on servers additionally ' | |
| 'requires a security assessment.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/gmail.modify'}}, | |
| 'ads': { 'id': 'ads', | |
| 'api': 'Google Ads API', | |
| 'version': 'v19', | |
| 'base_url': 'https://googleads.googleapis.com', | |
| 'batch_endpoint': None, | |
| 'auth_model': 'Google OAuth 2.0 + developer token', | |
| 'scope_required': True, | |
| 'generated': '2026-08-02', | |
| 'docs_url': 'https://developers.google.com/google-ads/api/docs/oauth/overview', | |
| 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires only ' | |
| 'basic OAuth App Verification.', | |
| 'sensitive': 'Provides access to specific Google user data that ' | |
| 'users authorize. Requires additional OAuth App ' | |
| 'Verification.', | |
| 'restricted': 'Provides wide access to Google user data. Requires ' | |
| 'restricted-scope verification and (if ' | |
| 'stored/transmitted on servers) a security ' | |
| 'assessment.'}, | |
| 'scopes': [ { 'name': 'adwords', | |
| 'uri': 'https://www.googleapis.com/auth/adwords', | |
| 'description': 'See and manage your Google Ads accounts.', | |
| 'permission_level': 'restricted', | |
| 'required': True, | |
| 'recommended': True, | |
| 'reason': 'The sole scope used by the Google Ads API. All Google Ads API calls ' | |
| 'require this scope plus a valid developer token.', | |
| 'least_privilege_recommendation': 'Always request. There is no narrower alternative ' | |
| 'for Google Ads API access.'}, | |
| { 'name': 'admanager.readonly', | |
| 'uri': 'https://www.googleapis.com/auth/admanager.readonly', | |
| 'description': 'See and manage your Google Ad Manager data (read-only).', | |
| 'permission_level': 'restricted', | |
| 'required': False, | |
| 'recommended': False, | |
| 'reason': 'For Google Ad Manager (DoubleClick) integrations; not needed for Google ' | |
| 'Ads API.', | |
| 'least_privilege_recommendation': 'Request only when the integration also touches ' | |
| 'Ad Manager.'}], | |
| 'recommended_combinations': {'google_ads_api': ['https://www.googleapis.com/auth/adwords']}, | |
| 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, | |
| 'refresh_token_unused_invalidates_after_months': 6, | |
| 'max_refresh_tokens_per_account_per_client': 100, | |
| 'developer_token': 'In addition to OAuth scopes, every request requires a ' | |
| 'Google Ads developer token issued by the Google Ads API ' | |
| 'center. The token and OAuth consent are managed in the ' | |
| 'API center.', | |
| 'verification_requirement': 'The adwords scope is RESTRICTED and requires ' | |
| 'restricted-scope OAuth App Verification and a ' | |
| 'security assessment.', | |
| 'default_scope_request': 'https://www.googleapis.com/auth/adwords'}}} | |