from __future__ import annotations from typing import Any, Dict # Google per-API scope catalog as an in-memory Python data structure. # Source of truth: app/services/google_scopes_data.py (no JSON files). # Permission levels: "non-sensitive" | "sensitive" | "restricted". GOOGLE_APIS: Dict[str, Dict[str, Any]] = { 'maps_static': { 'id': 'maps_static', 'api': 'Google Maps Static API', 'version': 'v1', 'base_url': 'https://maps.googleapis.com/maps/api/staticmap', 'batch_endpoint': None, 'auth_model': 'API Key (no OAuth)', 'scope_required': False, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/maps/documentation/maps-static/overview', 'info': 'Authenticates with a server-side API key only (optionally URL-signed). No OAuth ' 'scopes are required.', 'scopes': [], 'recommended_combinations': {}, 'production_notes': { 'key_restriction': 'Restrict the API key by IP address in Google ' 'Cloud Console > APIs & Services > Credentials.', 'billing_required': True, 'signature': 'Use a digital signature (signing secret) when URL ' 'usage is visible to end users.'}}, 'places': { 'id': 'places', 'api': 'Google Places API', 'version': 'v1', 'base_url': 'https://places.googleapis.com/v1', 'batch_endpoint': None, 'auth_model': 'API Key (no OAuth)', 'scope_required': False, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/maps/documentation/places/web-service/overview', 'info': 'Authenticates with an API key. The new Places API also supports OAuth bearer tokens, ' 'but it is not required and no dedicated user-data scopes exist. API-key ' 'authentication is the standard path.', 'scopes': [], 'recommended_combinations': {}, 'production_notes': { 'key_restriction': 'Restrict the API key by IP address and allowed ' 'Google Maps APIs.', 'billing_required': True, 'oauth_optional': 'Requests can alternatively carry an OAuth access ' 'token in the Authorization header, but no user-data ' 'scopes are defined for Places.'}}, 'geocoding': { 'id': 'geocoding', 'api': 'Google Geocoding API', 'version': 'v1', 'base_url': 'https://maps.googleapis.com/maps/api/geocode', 'batch_endpoint': None, 'auth_model': 'API Key (no OAuth)', 'scope_required': False, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/maps/documentation/geocoding/overview', 'info': 'Authenticates with an API key. No OAuth scopes are required.', 'scopes': [], 'recommended_combinations': {}, 'production_notes': { 'key_restriction': 'Restrict the API key by IP address and allowed ' 'Google Maps APIs.', 'billing_required': True}}, 'gemini': { 'id': 'gemini', 'api': 'Google Gemini API (public)', 'version': 'v1beta', 'base_url': 'https://generativelanguage.googleapis.com/v1beta', 'batch_endpoint': None, 'auth_model': 'API Key (no OAuth)', 'scope_required': False, 'generated': '2026-08-02', 'docs_url': 'https://ai.google.dev/gemini-api/docs', 'info': 'Authenticates with an API key via the X-Goog-Api-Key header or key query parameter. ' 'No OAuth scopes are required.', 'scopes': [], 'recommended_combinations': {}, 'production_notes': { 'key_restriction': 'Restrict the API key to the Generative Language API ' 'in Google Cloud Console.', 'billing_required': False, 'free_tier': 'The public Gemini API has a free tier; higher quotas ' 'require billing.'}}, 'cloud_ai': { 'id': 'cloud_ai', 'api': 'Google Cloud AI (Vision, Translate)', 'version': 'v1', 'base_url': 'https://vision.googleapis.com/v1', 'batch_endpoint': None, 'auth_model': 'API Key or Service Account (no user OAuth)', 'scope_required': False, 'generated': '2026-08-02', 'docs_url': 'https://cloud.google.com/docs/authentication', 'info': 'Vision and Translate use either an API key or a service account for authentication. ' 'No user OAuth scopes are required. If an end-user OAuth flow is ever used instead, ' 'the broad cloud-platform scope applies, but it is not needed for the standard ' 'API-key/service-account path.', 'scopes': [], 'recommended_combinations': {}, 'production_notes': { 'key_restriction': 'Restrict the API key to the Cloud Vision and Cloud ' 'Translation APIs.', 'service_account': 'Preferred for server-to-server calls: attach the ' 'service account to the instance or use an ' 'ADC-signed token.', 'billing_required': True}}, 'cloud_storage': { 'id': 'cloud_storage', 'api': 'Google Cloud Storage', 'version': 'v1', 'base_url': 'https://storage.googleapis.com/storage/v1', 'batch_endpoint': None, 'auth_model': 'Service Account (no user OAuth)', 'scope_required': False, 'generated': '2026-08-02', 'docs_url': 'https://cloud.google.com/storage/docs/authentication', 'info': 'Authenticates with a service account (application-default credentials) or a ' 'signed URL. No user OAuth scopes are required. The legacy devstorage scopes ' 'exist only for end-user OAuth flows and are not needed here.', 'scopes': [], 'recommended_combinations': {}, 'production_notes': { 'service_account': 'Grant the service account the Storage Object ' 'Admin / Storage Object Viewer roles on the ' 'target buckets.', 'signed_urls': 'Use query-parameter signatures for time-limited ' 'public download/upload URLs.', 'billing_required': True}}, 'oauth_signin': { 'id': 'oauth_signin', 'api': 'Google OAuth 2.0 Sign-In (Identity / OIDC)', 'version': 'oidc', 'base_url': 'https://oauth2.googleapis.com', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (OpenID Connect)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/identity/openid-connect/openid-connect', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. ' 'Requires only basic OAuth App ' 'Verification.', 'sensitive': 'Provides access to specific Google user ' 'data that users authorize. Requires ' 'additional OAuth App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification ' 'and (if stored/transmitted on servers) a ' 'security assessment.'}, 'scopes': [ { 'name': 'openid', 'uri': 'openid', 'description': 'OpenID Connect authentication; returns the ID token with a ' 'stable subject identifier (sub).', 'permission_level': 'non-sensitive', 'required': True, 'recommended': True, 'reason': 'Core OIDC scope; required to receive an id_token.', 'least_privilege_recommendation': 'Always request. Keep it combined with ' 'email and profile for basic identity.'}, { 'name': 'email', 'uri': 'https://www.googleapis.com/auth/userinfo.email', 'description': 'See your primary Google Account email address.', 'permission_level': 'non-sensitive', 'required': True, 'recommended': True, 'reason': "Used to read the user's verified primary email address.", 'least_privilege_recommendation': 'Request only when the app needs the ' "user's email address for account " 'mapping.'}, { 'name': 'profile', 'uri': 'https://www.googleapis.com/auth/userinfo.profile', 'description': 'See your personal info, including any personal info you ' 'have made publicly available.', 'permission_level': 'non-sensitive', 'required': True, 'recommended': True, 'reason': "Used to read the user's name, picture, locale and other profile " 'fields.', 'least_privilege_recommendation': 'Request only when the app needs profile ' 'display data.'}, { 'name': 'userinfo.email', 'uri': 'https://www.googleapis.com/auth/userinfo.email', 'description': 'See your primary Google Account email address (legacy ' 'alias of email).', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Legacy duplicate of the email scope.', 'least_privilege_recommendation': 'Prefer the openid/email/profile ' 'combination; avoid requesting the ' 'legacy alias twice.'}, { 'name': 'userinfo.profile', 'uri': 'https://www.googleapis.com/auth/userinfo.profile', 'description': 'See your personal info (legacy alias of profile).', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Legacy duplicate of the profile scope.', 'least_privilege_recommendation': 'Prefer the openid/email/profile ' 'combination; avoid requesting the ' 'legacy alias twice.'}], 'recommended_combinations': { 'default': [ 'openid', 'https://www.googleapis.com/auth/userinfo.email', 'https://www.googleapis.com/auth/userinfo.profile']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'None of these scopes are ' 'sensitive/restricted, so only basic ' 'OAuth App Verification is needed.', 'default_scope_request': 'openid email profile'}}, 'people': { 'id': 'people', 'api': 'Google People API (Contacts)', 'version': 'v1', 'base_url': 'https://people.googleapis.com/v1', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/people/v1/contacts', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data ' 'that users authorize. Requires additional OAuth ' 'App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and (if ' 'stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'contacts.readonly', 'uri': 'https://www.googleapis.com/auth/contacts.readonly', 'description': 'Read all of your Google Contacts.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'Core read capability for contact automation: list/get contacts, ' 'contact groups and search.', 'least_privilege_recommendation': 'Default scope for reading contacts. Upgrade ' 'to contacts (read/write) only when the app ' 'must create or modify contacts.'}, { 'name': 'contacts', 'uri': 'https://www.googleapis.com/auth/contacts', 'description': 'Read, write, and manage your contacts.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Read/write access to the user's entire contact list.", 'least_privilege_recommendation': 'Request only when creating/editing/deleting ' 'contacts is a hard requirement; otherwise ' 'stay read-only.'}, { 'name': 'contacts.other.readonly', 'uri': 'https://www.googleapis.com/auth/contacts.other.readonly', 'description': 'Read the contact information of other people that a given ' 'contact has shared with you.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Access to a contact's 'other contacts' (secondary people).", 'least_privilege_recommendation': 'Rarely needed; omit unless the app must read ' "a contact's own address book."}, { 'name': 'directory.readonly', 'uri': 'https://www.googleapis.com/auth/directory.readonly', 'description': 'Read the list of people in your domain (Google Workspace ' 'directory).', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Company directory access; only meaningful for Google Workspace ' 'domains.', 'least_privilege_recommendation': 'Request only for Workspace directory use ' 'cases; requires a Workspace admin to grant ' 'access.'}], 'recommended_combinations': { 'read_only': [ 'https://www.googleapis.com/auth/contacts.readonly'], 'read_write': ['https://www.googleapis.com/auth/contacts']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'All contacts scopes are RESTRICTED and ' 'require restricted-scope OAuth App ' 'Verification and a security assessment if ' 'data is stored/transmitted on servers.', 'default_scope_request': 'https://www.googleapis.com/auth/contacts.readonly'}}, 'calendar': { 'id': 'calendar', 'api': 'Google Calendar API', 'version': 'v3', 'base_url': 'https://www.googleapis.com/calendar/v3', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/calendar/api/auth', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data ' 'that users authorize. Requires additional ' 'OAuth App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and ' '(if stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'calendar.events', 'uri': 'https://www.googleapis.com/auth/calendar.events', 'description': 'See, edit, share, and permanently delete the calendars you can ' 'access using Google Calendar.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'Core read/write for events (create/update/delete events) without ' 'exposing calendar settings or the full ACL model.', 'least_privilege_recommendation': 'Default scope for event automation. Prefer ' 'calendar.events.readonly when the app never ' 'writes events.'}, { 'name': 'calendar.events.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.events.readonly', 'description': 'View events on all your calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to events across all calendars.', 'least_privilege_recommendation': 'Use for read-only event automation ' '(scheduling checks, availability).'}, { 'name': 'calendar.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.readonly', 'description': 'See and download any calendar you can access using your Google ' 'Calendar.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to calendars including metadata and events.', 'least_privilege_recommendation': 'Use when the app needs to read calendar ' 'metadata and settings, not just events.'}, { 'name': 'calendar', 'uri': 'https://www.googleapis.com/auth/calendar', 'description': 'See, edit, share, and permanently delete the calendars you can ' 'access using Google Calendar.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Full access to all Calendar functionality including sharing and ' 'ACLs.', 'least_privilege_recommendation': 'Avoid. calendar.events + ' 'calendar.settings.readonly cover most ' 'automation with a smaller surface.'}, { 'name': 'calendar.freebusy', 'uri': 'https://www.googleapis.com/auth/calendar.freebusy', 'description': 'See free/busy availability for attendees and calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Only returns busy/free blocks, never event details.', 'least_privilege_recommendation': 'Use for availability checks that must not ' 'expose event content.'}, { 'name': 'calendar.settings.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.settings.readonly', 'description': "See your primary account's Calendar settings.", 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Read-only access to the user's calendar settings (timezone, working " 'hours).', 'least_privilege_recommendation': 'Request alongside calendar.events only if ' 'settings/working-hours are needed.'}, { 'name': 'calendar.calendarlist.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.calendarlist.readonly', 'description': 'View calendars you own or subscribe to.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Lists the user's calendar subscriptions and their visibility/color " 'metadata.', 'least_privilege_recommendation': 'Use when the app must enumerate subscribed ' 'calendars without full read/write.'}, { 'name': 'calendar.calendarlist', 'uri': 'https://www.googleapis.com/auth/calendar.calendarlist', 'description': 'See, edit, and delete your Google Calendar lists.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Manage the user's calendar list (add/remove subscribed calendars).", 'least_privilege_recommendation': 'Request only when the app manages calendar ' 'subscriptions.'}, { 'name': 'calendar.calendars.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.calendars.readonly', 'description': 'View your Calendar events and details.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to calendar metadata (name, description, ' 'timezone).', 'least_privilege_recommendation': 'Narrower than calendar.readonly; use when ' 'only calendar-level metadata is needed.'}, { 'name': 'calendar.calendars', 'uri': 'https://www.googleapis.com/auth/calendar.calendars', 'description': 'View and edit the metadata of your calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write calendar metadata without event or ACL access.', 'least_privilege_recommendation': 'Request only when the app edits calendar ' 'metadata.'}, { 'name': 'calendar.acls.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.acls.readonly', 'description': 'See who has access to your calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to calendar sharing rules.', 'least_privilege_recommendation': 'Request only for sharing/visibility ' 'audits.'}, { 'name': 'calendar.acls', 'uri': 'https://www.googleapis.com/auth/calendar.acls', 'description': 'See, edit, and share your calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write calendar sharing (ACL) rules.', 'least_privilege_recommendation': 'Request only when the app manages calendar ' 'sharing.'}, { 'name': 'calendar.events.owned.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.events.owned.readonly', 'description': 'See the events you own.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to events the user owns (not events shared with ' 'them).', 'least_privilege_recommendation': 'Narrower read option when the app only ' "needs the user's own events."}, { 'name': 'calendar.events.owned', 'uri': 'https://www.googleapis.com/auth/calendar.events.owned', 'description': 'See, edit, share, and permanently delete the calendars you can ' 'access using Google Calendar (own events).', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write for events the user owns.', 'least_privilege_recommendation': 'Use when the app only manages events ' 'created by the user.'}, { 'name': 'calendar.app.created', 'uri': 'https://www.googleapis.com/auth/calendar.app.created', 'description': 'Create and manage events on secondary calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Creates events in secondary calendars for the app.', 'least_privilege_recommendation': 'Request only when the app needs its own ' 'secondary calendar.'}, { 'name': 'calendar.events.public.readonly', 'uri': 'https://www.googleapis.com/auth/calendar.events.public.readonly', 'description': 'View public events on all your calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to public events only.', 'least_privilege_recommendation': 'Use only when the app strictly needs public ' 'event data.'}, { 'name': 'calendar.events.freebusy', 'uri': 'https://www.googleapis.com/auth/calendar.events.freebusy', 'description': 'View free/busy information for your calendars.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Free/busy only, without event details.', 'least_privilege_recommendation': 'Similar to calendar.freebusy; use the ' 'narrower single scope.'}, { 'name': 'calendar.addons.execute', 'uri': 'https://www.googleapis.com/auth/calendar.addons.execute', 'description': 'Run your add-on (Calendar add-on runtime).', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Required to run a Calendar add-on; not needed for server-side ' 'automation.', 'least_privilege_recommendation': 'Skip for backend automation.'}, { 'name': 'calendar.addons.current.event.read', 'uri': 'https://www.googleapis.com/auth/calendar.addons.current.event.read', 'description': 'See the event details of the calendar event where the add-on ' 'is displayed.', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Reads the event the add-on card is attached to.', 'least_privilege_recommendation': 'Skip for backend automation; add-on context ' 'only.'}, { 'name': 'calendar.addons.current.event.write', 'uri': 'https://www.googleapis.com/auth/calendar.addons.current.event.write', 'description': 'See, edit, share, and permanently delete the event where the ' 'add-on is displayed.', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Writes the event the add-on card is attached to.', 'least_privilege_recommendation': 'Skip for backend automation; add-on context ' 'only.'}], 'recommended_combinations': { 'read_only_events': [ 'https://www.googleapis.com/auth/calendar.events.readonly'], 'event_crud': [ 'https://www.googleapis.com/auth/calendar.events'], 'availability_only': [ 'https://www.googleapis.com/auth/calendar.freebusy'], 'full_calendar': ['https://www.googleapis.com/auth/calendar']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'Most calendar scopes are RESTRICTED and ' 'require restricted-scope OAuth App ' 'Verification and a security assessment if ' 'data is stored/transmitted on servers.', 'default_scope_request': 'https://www.googleapis.com/auth/calendar.events'}}, 'sheets': { 'id': 'sheets', 'api': 'Google Sheets API', 'version': 'v4', 'base_url': 'https://sheets.googleapis.com/v4', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/workspace/sheets/api/scopes', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data ' 'that users authorize. Requires additional OAuth ' 'App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and (if ' 'stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'drive.file', 'uri': 'https://www.googleapis.com/auth/drive.file', 'description': 'See, edit, create, and delete only the specific Google Drive ' 'files you use with this app.', 'permission_level': 'non-sensitive', 'required': True, 'recommended': True, 'reason': 'Per-file access scoped to spreadsheets the user opened/created with ' "the app. Google's recommended minimal scope for Sheets.", 'least_privilege_recommendation': 'Default scope for spreadsheet automation. ' 'Request it before spreadsheets to keep the ' 'risk surface minimal.'}, { 'name': 'spreadsheets.readonly', 'uri': 'https://www.googleapis.com/auth/spreadsheets.readonly', 'description': 'See all your Google Sheets spreadsheets.', 'permission_level': 'sensitive', 'required': False, 'recommended': False, 'reason': "Read-only access to all spreadsheets in the user's Drive.", 'least_privilege_recommendation': 'Use for read-only spreadsheet automation that ' 'must address files by URL.'}, { 'name': 'spreadsheets', 'uri': 'https://www.googleapis.com/auth/spreadsheets', 'description': 'See, edit, create, and delete all of your Google Sheets files.', 'permission_level': 'sensitive', 'required': False, 'recommended': False, 'reason': "Read/write access to all spreadsheets in the user's Drive.", 'least_privilege_recommendation': 'Request only when the app must address any ' 'spreadsheet by URL and drive.file is ' 'insufficient.'}, { 'name': 'drive.readonly', 'uri': 'https://www.googleapis.com/auth/drive.readonly', 'description': 'See and download all your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Broad read access to the entire Drive, including spreadsheets.', 'least_privilege_recommendation': 'Avoid unless the app needs other Drive file ' 'types alongside sheets.'}, { 'name': 'drive', 'uri': 'https://www.googleapis.com/auth/drive', 'description': 'See, edit, create, and delete all of your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Full read/write access to the entire Drive.', 'least_privilege_recommendation': 'Avoid. Prefer drive.file or spreadsheets.'}], 'recommended_combinations': { 'per_file_automation': [ 'https://www.googleapis.com/auth/drive.file'], 'read_only_by_url': [ 'https://www.googleapis.com/auth/spreadsheets.readonly'], 'read_write_by_url': [ 'https://www.googleapis.com/auth/spreadsheets']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'spreadsheets/spreadsheets.readonly are ' 'SENSITIVE; drive and drive.readonly are ' 'RESTRICTED and require restricted-scope ' 'verification.', 'default_scope_request': 'https://www.googleapis.com/auth/drive.file'}}, 'youtube': { 'id': 'youtube', 'api': 'YouTube Data API', 'version': 'v3', 'base_url': 'https://www.googleapis.com/youtube/v3', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/youtube/v3/guides/auth', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data ' 'that users authorize. Requires additional OAuth ' 'App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and (if ' 'stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'youtube.readonly', 'uri': 'https://www.googleapis.com/auth/youtube.readonly', 'description': 'See a list of your YouTube videos and playlists and related ' 'information such as view counts, comments, and ratings.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'Core read capability for channel/video metadata, playlists, comments ' 'and search.', 'least_privilege_recommendation': 'Default scope for read-only YouTube ' 'automation.'}, { 'name': 'youtube.upload', 'uri': 'https://www.googleapis.com/auth/youtube.upload', 'description': 'Manage your YouTube videos.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Upload videos to the user's channel. No read access to channel data.", 'least_privilege_recommendation': 'Use for upload pipelines that do not need to ' 'read channel metadata.'}, { 'name': 'youtube.force-ssl', 'uri': 'https://www.googleapis.com/auth/youtube.force-ssl', 'description': 'See, edit, and permanently delete your YouTube videos, ratings, ' 'comments and captions.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write for videos, ratings, comments, captions and playlists.', 'least_privilege_recommendation': 'Request when the app must edit or delete ' 'content; combine with youtube.upload for ' 'uploads.'}, { 'name': 'youtube', 'uri': 'https://www.googleapis.com/auth/youtube', 'description': 'Manage your YouTube account.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Full account management, including channel settings.', 'least_privilege_recommendation': 'Avoid unless account-level management is ' 'required.'}, { 'name': 'youtube.channel-memberships.creator', 'uri': 'https://www.googleapis.com/auth/youtube.channel-memberships.creator', 'description': 'See a list of your current active channel members, their ' 'current level, and when they became a member.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to channel membership data.', 'least_privilege_recommendation': 'Request only for creator membership ' 'analytics.'}, { 'name': 'youtubepartner', 'uri': 'https://www.googleapis.com/auth/youtubepartner', 'description': 'View and manage your assets and associated content on YouTube.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'YouTube Partner Program asset/content management.', 'least_privilege_recommendation': 'Request only for partner/MCN integrations.'}, { 'name': 'youtubepartner-channel-audit', 'uri': 'https://www.googleapis.com/auth/youtubepartner-channel-audit', 'description': 'View private information of your YouTube channel relevant ' 'during the audit process with a YouTube partner.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Channel audit data used by partners.', 'least_privilege_recommendation': 'Request only for partner audit workflows.'}], 'recommended_combinations': { 'read_only': [ 'https://www.googleapis.com/auth/youtube.readonly'], 'upload_only': [ 'https://www.googleapis.com/auth/youtube.upload'], 'read_write': [ 'https://www.googleapis.com/auth/youtube.force-ssl'], 'read_write_and_upload': [ 'https://www.googleapis.com/auth/youtube.force-ssl', 'https://www.googleapis.com/auth/youtube.upload']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'All YouTube scopes are RESTRICTED and ' 'require restricted-scope OAuth App ' 'Verification and a security assessment if ' 'data is stored/transmitted on servers.', 'default_scope_request': 'https://www.googleapis.com/auth/youtube.readonly'}}, 'drive': { 'id': 'drive', 'api': 'Google Drive API', 'version': 'v3', 'base_url': 'https://www.googleapis.com/drive/v3', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/workspace/drive/api/guides/api-specific-auth', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data that ' 'users authorize. Requires additional OAuth App ' 'Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and (if ' 'stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'drive.file', 'uri': 'https://www.googleapis.com/auth/drive.file', 'description': 'See, edit, create, and delete only the specific Google Drive ' 'files you use with this app.', 'permission_level': 'non-sensitive', 'required': True, 'recommended': True, 'reason': "Google's recommended default: per-file access limited to files the app " 'created or opened.', 'least_privilege_recommendation': 'Default scope for Drive automation. Upgrade ' 'only when the app must address arbitrary files ' 'by ID/URL.'}, { 'name': 'drive.metadata.readonly', 'uri': 'https://www.googleapis.com/auth/drive.metadata.readonly', 'description': 'See information about your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to file metadata (name, mimeType, parents) without ' 'content.', 'least_privilege_recommendation': 'Use for indexing/listing that does not need ' "file content. Google's recommended minimal " 'metadata scope.'}, { 'name': 'drive.readonly', 'uri': 'https://www.googleapis.com/auth/drive.readonly', 'description': 'See and download all your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to all files and their content.', 'least_privilege_recommendation': 'Use for read-only automation addressing files ' 'by ID/URL.'}, { 'name': 'drive', 'uri': 'https://www.googleapis.com/auth/drive', 'description': 'See, edit, create, and delete all of your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Full read/write access to the entire Drive.', 'least_privilege_recommendation': 'Avoid. Prefer drive.file whenever possible.'}, { 'name': 'drive.metadata', 'uri': 'https://www.googleapis.com/auth/drive.metadata', 'description': 'See, edit, create, and delete only the specific Google Drive ' 'files you use with this app (metadata only).', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write file metadata only, no content.', 'least_privilege_recommendation': 'Rarely needed; request only when metadata must ' 'be modified.'}, { 'name': 'drive.appdata', 'uri': 'https://www.googleapis.com/auth/drive.appdata', 'description': 'View and manage its own configuration data in your Google Drive.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': "Access only to the app's private appdata folder.", 'least_privilege_recommendation': 'Request only when using the Drive appdata ' 'folder for per-user config.'}, { 'name': 'drive.apps.readonly', 'uri': 'https://www.googleapis.com/auth/drive.apps.readonly', 'description': "See and download your application's data using Google Drive.", 'permission_level': 'sensitive', 'required': False, 'recommended': False, 'reason': "Read-only access to the app's own data in Drive.", 'least_privilege_recommendation': 'Request only when the app must access files it ' 'created in Drive.'}, { 'name': 'drive.scripts', 'uri': 'https://www.googleapis.com/auth/drive.scripts', 'description': 'See, edit, create, and delete your scripts in Google Apps Script.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Access to Apps Script projects.', 'least_privilege_recommendation': 'Request only for Apps Script management.'}, { 'name': 'drive.install', 'uri': 'https://www.googleapis.com/auth/drive.install', 'description': 'Add or remove yourself as an editor of documents your app opens.', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': "Used with the Drive UI 'Open with' flow.", 'least_privilege_recommendation': 'Request only when integrating with the Drive ' 'web UI.'}, { 'name': 'drive.activity', 'uri': 'https://www.googleapis.com/auth/drive.activity', 'description': 'View the activity history of your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write visibility into Drive activity history.', 'least_privilege_recommendation': 'Request only for audit/activity features.'}, { 'name': 'drive.activity.readonly', 'uri': 'https://www.googleapis.com/auth/drive.activity.readonly', 'description': 'View the activity history of your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to Drive activity history.', 'least_privilege_recommendation': 'Prefer this over drive.activity when no writes ' 'are needed.'}, { 'name': 'drive.photos.readonly', 'uri': 'https://www.googleapis.com/auth/drive.photos.readonly', 'description': 'View the files and photos in your Google Photos library.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to the Google Photos library.', 'least_privilege_recommendation': 'Request only for Google Photos integration.'}, { 'name': 'drive.meet.readonly', 'uri': 'https://www.googleapis.com/auth/drive.meet.readonly', 'description': 'See and download all your Google Meet recordings saved to Google ' 'Drive.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to Meet recordings stored in Drive.', 'least_privilege_recommendation': 'Request only for Meet recording workflows.'}], 'recommended_combinations': { 'per_file_automation': [ 'https://www.googleapis.com/auth/drive.file'], 'metadata_only': [ 'https://www.googleapis.com/auth/drive.metadata.readonly'], 'read_only_by_id': [ 'https://www.googleapis.com/auth/drive.readonly'], 'full_drive': ['https://www.googleapis.com/auth/drive']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'drive.file and drive.install are ' 'NON-SENSITIVE; drive.apps.readonly is ' 'SENSITIVE; the remaining scopes are ' 'RESTRICTED and require restricted-scope ' 'verification.', 'default_scope_request': 'https://www.googleapis.com/auth/drive.file'}}, 'admin_sdk': { 'id': 'admin_sdk', 'api': 'Google Workspace Admin SDK (Directory & Reports)', 'version': 'directory_v1 / reports_v1', 'base_url': 'https://admin.googleapis.com/admin', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 (typically domain-wide delegation via a service account)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/workspace/admin/directory/v1/guides/authorize', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data ' 'that users authorize. Requires additional ' 'OAuth App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and ' '(if stored/transmitted on servers) a ' 'security assessment.'}, 'scopes': [ { 'name': 'admin.directory.user.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.user.readonly', 'description': 'See information about users on your domain.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'Core read capability for directory user management.', 'least_privilege_recommendation': 'Default read scope for user directory ' 'automation.'}, { 'name': 'admin.directory.user', 'uri': 'https://www.googleapis.com/auth/admin.directory.user', 'description': 'See, edit, configure, and delete your Google Account.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write user lifecycle management (create, suspend, delete ' 'users).', 'least_privilege_recommendation': 'Request only when the app must ' 'create/update/delete users.'}, { 'name': 'admin.directory.group.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.group.readonly', 'description': 'See information about groups on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to group metadata.', 'least_privilege_recommendation': 'Use for read-only group listing.'}, { 'name': 'admin.directory.group', 'uri': 'https://www.googleapis.com/auth/admin.directory.group', 'description': 'See, edit, create, and delete all of your Google Group ' 'subscriptions.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write group management.', 'least_privilege_recommendation': 'Request only when the app manages groups.'}, { 'name': 'admin.directory.group.member.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.group.member.readonly', 'description': 'See information about members of groups on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to group memberships.', 'least_privilege_recommendation': 'Use for read-only membership listing.'}, { 'name': 'admin.directory.group.member', 'uri': 'https://www.googleapis.com/auth/admin.directory.group.member', 'description': 'See, edit, and manage membership of groups on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write group membership management.', 'least_privilege_recommendation': 'Request only when the app adds/removes ' 'group members.'}, { 'name': 'admin.directory.device.chromeos.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly', 'description': 'See information about your ChromeOS devices.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only ChromeOS device inventory.', 'least_privilege_recommendation': 'Request only for device inventory ' 'reporting.'}, { 'name': 'admin.directory.device.chromeos', 'uri': 'https://www.googleapis.com/auth/admin.directory.device.chromeos', 'description': 'See, edit, configure, and delete your ChromeOS devices.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write ChromeOS device management.', 'least_privilege_recommendation': 'Request only when managing ChromeOS ' 'devices.'}, { 'name': 'admin.directory.orgunit.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.orgunit.readonly', 'description': 'See information about organizational units on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to organizational units.', 'least_privilege_recommendation': 'Request only for OU-aware reporting.'}, { 'name': 'admin.directory.orgunit', 'uri': 'https://www.googleapis.com/auth/admin.directory.orgunit', 'description': 'See, edit, and configure organizational units on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write OU management.', 'least_privilege_recommendation': 'Request only when managing organizational ' 'units.'}, { 'name': 'admin.directory.rolemanagement.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly', 'description': 'See information about roles on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to admin roles.', 'least_privilege_recommendation': 'Request only for role auditing.'}, { 'name': 'admin.directory.rolemanagement', 'uri': 'https://www.googleapis.com/auth/admin.directory.rolemanagement', 'description': 'See, edit, and manage admin roles on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write admin role assignments.', 'least_privilege_recommendation': 'Request only when managing admin roles.'}, { 'name': 'admin.directory.domain.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.domain.readonly', 'description': 'See information about domains on your account.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to domain settings.', 'least_privilege_recommendation': 'Request only when domain metadata is ' 'needed.'}, { 'name': 'admin.directory.customer.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.customer.readonly', 'description': 'See information about your Google Workspace account.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to customer/account settings.', 'least_privilege_recommendation': 'Request only when account-level metadata ' 'is needed.'}, { 'name': 'admin.directory.userschema.readonly', 'uri': 'https://www.googleapis.com/auth/admin.directory.userschema.readonly', 'description': 'See information about custom user schemas on your domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to custom schema definitions.', 'least_privilege_recommendation': 'Request only when reading custom user ' 'attributes.'}, { 'name': 'admin.reports.audit.readonly', 'uri': 'https://www.googleapis.com/auth/admin.reports.audit.readonly', 'description': 'View audit reports for your Google Workspace domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to admin audit logs.', 'least_privilege_recommendation': 'Request only for audit/reporting ' 'features.'}, { 'name': 'admin.reports.usage.readonly', 'uri': 'https://www.googleapis.com/auth/admin.reports.usage.readonly', 'description': 'View usage reports for your Google Workspace domain.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access to usage metrics.', 'least_privilege_recommendation': 'Request only for usage analytics.'}, { 'name': 'admin.datatransfer', 'uri': 'https://www.googleapis.com/auth/admin.datatransfer', 'description': 'Manage the transfer of data between user accounts.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Performs/administers data-transfer requests between users.', 'least_privilege_recommendation': 'Request only for user data-transfer ' 'workflows.'}], 'recommended_combinations': { 'directory_read_users': [ 'https://www.googleapis.com/auth/admin.directory.user.readonly'], 'directory_full_users': [ 'https://www.googleapis.com/auth/admin.directory.user'], 'groups_read': [ 'https://www.googleapis.com/auth/admin.directory.group.readonly', 'https://www.googleapis.com/auth/admin.directory.group.member.readonly'], 'reports': [ 'https://www.googleapis.com/auth/admin.reports.audit.readonly']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'delegation': 'Admin APIs are normally called with domain-wide ' 'delegation from a service account using a Workspace ' 'super-admin account; the OAuth user flow only works ' 'for users with admin privileges.', 'verification_requirement': 'All admin.directory and admin.reports ' 'scopes are RESTRICTED and require ' 'restricted-scope verification and a ' 'security assessment.', 'default_scope_request': 'https://www.googleapis.com/auth/admin.directory.user.readonly'}}, 'bigquery': { 'id': 'bigquery', 'api': 'Google BigQuery API', 'version': 'v2', 'base_url': 'https://bigquery.googleapis.com/bigquery/v2', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 or Service Account (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://cloud.google.com/bigquery/docs/authentication', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data ' 'that users authorize. Requires additional ' 'OAuth App Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope verification and ' '(if stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'bigquery.readonly', 'uri': 'https://www.googleapis.com/auth/bigquery.readonly', 'description': 'View your data in Google BigQuery.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'Read-only access to datasets, tables, and query results.', 'least_privilege_recommendation': 'Default scope for analytics/reporting. ' 'Upgrade to bigquery only when the app must ' 'write or manage data.'}, { 'name': 'bigquery', 'uri': 'https://www.googleapis.com/auth/bigquery', 'description': 'View and manage your data in Google BigQuery.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read/write/delete data, datasets and jobs.', 'least_privilege_recommendation': 'Request only when the app inserts data, ' 'manages tables/datasets, or runs DDL/DML.'}, { 'name': 'bigquery.insertdata', 'uri': 'https://www.googleapis.com/auth/bigquery.insertdata', 'description': 'Insert data into your Google BigQuery tables.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Insert-only (streaming/bulk insert) without the ability to modify ' 'schema.', 'least_privilege_recommendation': 'Use for ingest-only pipelines.'}, { 'name': 'cloud-platform', 'uri': 'https://www.googleapis.com/auth/cloud-platform', 'description': 'See, edit, configure, and delete your Google Cloud data and ' 'see the email address for your Google Account.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Broad access to all Google Cloud resources for the signed-in user.', 'least_privilege_recommendation': 'Avoid for user OAuth; use it only as a ' 'fallback when the app is itself a GCP ' 'management tool.'}, { 'name': 'cloud-platform.read-only', 'uri': 'https://www.googleapis.com/auth/cloud-platform.read-only', 'description': 'View your data across Google Cloud Platform services.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Read-only access across GCP services.', 'least_privilege_recommendation': 'Prefer the narrower bigquery.readonly ' 'scope.'}, { 'name': 'devstorage.read_only', 'uri': 'https://www.googleapis.com/auth/devstorage.read_only', 'description': 'View your data in Google Cloud Storage.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Required to load data directly from files in Cloud Storage into ' 'BigQuery.', 'least_privilege_recommendation': 'Request only when jobs load from GCS ' 'objects.'}, { 'name': 'drive.readonly', 'uri': 'https://www.googleapis.com/auth/drive.readonly', 'description': 'See and download all your Google Drive files.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Required to query external tables that reference Google Drive files ' '(e.g., Google Sheets).', 'least_privilege_recommendation': 'Request only when querying Drive-backed ' 'external tables.'}], 'recommended_combinations': { 'read_only_analytics': [ 'https://www.googleapis.com/auth/bigquery.readonly'], 'read_write': ['https://www.googleapis.com/auth/bigquery'], 'ingest_only': [ 'https://www.googleapis.com/auth/bigquery.insertdata'], 'load_from_gcs': [ 'https://www.googleapis.com/auth/bigquery', 'https://www.googleapis.com/auth/devstorage.read_only']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'bigquery* and cloud-platform scopes are ' 'RESTRICTED and require restricted-scope ' 'verification and a security assessment.', 'service_account': 'Server-to-server automation should prefer a ' 'service account over user OAuth; the same scopes ' 'are requested during impersonation.', 'default_scope_request': 'https://www.googleapis.com/auth/bigquery.readonly'}}, 'gmail': { 'id': 'gmail', 'api': 'Gmail API', 'version': 'v1', 'base_url': 'https://gmail.googleapis.com/gmail/v1', 'batch_endpoint': 'https://gmail.googleapis.com/batch/gmail/v1', 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/gmail/api/auth/scopes', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' 'only basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data that ' 'users authorize. Requires additional OAuth App ' 'Verification.', 'restricted': 'Provides wide access to Google user data. ' 'Requires restricted-scope OAuth App Verification ' 'and (if data is stored/transmitted on servers) a ' 'security assessment.'}, 'scopes': [ { 'name': 'gmail.addons.current.action.compose', 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.action.compose', 'description': 'Manage drafts and send emails when you interact with the add-on.', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Only required for Gmail add-on context (cards running inside the Gmail ' 'UI). Not needed for server-side mailbox automation.', 'least_privilege_recommendation': 'Skip. Use gmail.compose (server-side) instead; ' 'this scope only works inside the add-on ' 'runtime.'}, { 'name': 'gmail.addons.current.message.action', 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.action', 'description': 'View your email messages when you interact with the add-on.', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Add-on UI only. Useless for backend automation.', 'least_privilege_recommendation': 'Skip. Use gmail.readonly or gmail.metadata ' 'from a server context.'}, { 'name': 'gmail.labels', 'uri': 'https://www.googleapis.com/auth/gmail.labels', 'description': 'See and edit your email labels.', 'permission_level': 'non-sensitive', 'required': False, 'recommended': False, 'reason': 'Required only when the app must create/update/delete labels or manage ' 'label-based inbox organization.', 'least_privilege_recommendation': 'Request only when label CRUD is needed. If the ' 'app only reads labels embedded in messages, ' 'gmail.metadata suffices.'}, { 'name': 'gmail.addons.current.message.metadata', 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.metadata', 'description': 'View your email message metadata when the add-on is running.', 'permission_level': 'sensitive', 'required': False, 'recommended': False, 'reason': 'Add-on UI only.', 'least_privilege_recommendation': 'Skip for server-side automation. Use ' 'gmail.metadata.'}, { 'name': 'gmail.addons.current.message.readonly', 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.readonly', 'description': 'View your email messages when the add-on is running.', 'permission_level': 'sensitive', 'required': False, 'recommended': False, 'reason': 'Add-on UI only.', 'least_privilege_recommendation': 'Skip for server-side automation. Use ' 'gmail.readonly.'}, { 'name': 'gmail.send', 'uri': 'https://www.googleapis.com/auth/gmail.send', 'description': 'Send email on your behalf.', 'permission_level': 'sensitive', 'required': False, 'recommended': False, 'reason': 'Send-only automation (outbound notification engines) that never needs ' 'to read the mailbox.', 'least_privilege_recommendation': 'Use when the app sends email but does NOT need ' 'to read the inbox. Pairs well with a separate ' 'read scope if inbox reading is also needed.'}, { 'name': 'gmail.compose', 'uri': 'https://www.googleapis.com/auth/gmail.compose', 'description': 'Manage drafts and send emails.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Draft-first workflows (approval flows) plus sending. Does not grant ' 'read access to the inbox.', 'least_privilege_recommendation': 'Choose over gmail.send when drafts must be ' 'managed, but the app never reads inbox ' 'messages.'}, { 'name': 'gmail.metadata', 'uri': 'https://www.googleapis.com/auth/gmail.metadata', 'description': 'View your email message metadata such as labels and headers, but ' 'not the email body.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Indexing/analytics that only needs headers and labels without message ' 'bodies.', 'least_privilege_recommendation': 'Strongly preferred over gmail.readonly when ' 'body text is not required. Significantly ' 'reduces data exposure.'}, { 'name': 'gmail.readonly', 'uri': 'https://www.googleapis.com/auth/gmail.readonly', 'description': 'View your email messages and settings.', 'permission_level': 'restricted', 'required': True, 'recommended': False, 'reason': 'Core read capability for mailbox automation: list/get messages, ' 'threads, drafts, attachments, labels and settings. Cannot write.', 'least_privilege_recommendation': 'Use for read-only automation. Combine with ' 'gmail.modify only if the app must also change ' 'labels/read state. Do NOT request when ' 'gmail.metadata satisfies the requirement.'}, { 'name': 'gmail.modify', 'uri': 'https://www.googleapis.com/auth/gmail.modify', 'description': 'Read, compose, and send emails from your Gmail account. This ' 'scope does not allow immediate, permanent deletion of threads and ' 'messages, bypassing the trash.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'End-to-end mailbox management: read, send, trash, label, modify read ' "state, manage drafts/threads. The recommended 'full CRUD' scope " 'because permanent delete stays behind trash.', 'least_privilege_recommendation': 'Default scope for complete mailbox automation. ' 'Prefer over https://mail.google.com/ whenever ' 'possible; it covers all operations except ' 'immediate permanent deletion.'}, { 'name': 'gmail.insert', 'uri': 'https://www.googleapis.com/auth/gmail.insert', 'description': 'Add emails into your Gmail mailbox.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Mailbox migration, archiving, or importing historical messages.', 'least_privilege_recommendation': 'Request only for import/migration flows. ' 'Combined with gmail.readonly if the app also ' 'reads existing mail.'}, { 'name': 'gmail.settings.basic', 'uri': 'https://www.googleapis.com/auth/gmail.settings.basic', 'description': 'See, edit, create, or change your email settings and filters in ' 'Gmail.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Automating mailbox configuration: filters, forwarding addresses, ' 'vacation responders, IMAP/POP toggles.', 'least_privilege_recommendation': 'Request only when the app manages mailbox ' 'settings/filters. Otherwise omit to limit ' 'scope.'}, { 'name': 'gmail.settings.sharing', 'uri': 'https://www.googleapis.com/auth/gmail.settings.sharing', 'description': 'Manage your sensitive mail settings, including who can manage ' 'your mail.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Granting/revoking mail delegation (Google Workspace). Operations ' 'guarded by this scope are administrative and normally use domain-wide ' 'delegation via a service account.', 'least_privilege_recommendation': 'Request only for Workspace admin/delegation ' 'use cases. Requires extra verification; not ' 'needed for ordinary per-user automation.'}, { 'name': 'mail.google.com', 'uri': 'https://mail.google.com/', 'description': 'Read, compose, send, and permanently delete all your email from ' 'Gmail.', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'Only needed when the app must permanently delete threads/messages ' 'immediately, bypassing trash.', 'least_privilege_recommendation': 'Avoid. Request only when immediate permanent ' 'deletion is a hard requirement; otherwise ' 'gmail.modify covers everything else with a ' 'much smaller risk surface.'}], 'recommended_combinations': { 'read_only_automation': [ 'https://www.googleapis.com/auth/gmail.readonly'], 'metadata_only_automation': [ 'https://www.googleapis.com/auth/gmail.metadata'], 'full_mailbox_crud': [ 'https://www.googleapis.com/auth/gmail.modify', 'https://www.googleapis.com/auth/gmail.send', 'https://www.googleapis.com/auth/gmail.settings.basic'], 'full_mailbox_crud_with_permanent_delete': [ 'https://mail.google.com/', 'https://www.googleapis.com/auth/gmail.settings.basic'], 'send_only': ['https://www.googleapis.com/auth/gmail.send']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'verification_requirement': 'RESTRICTED and SENSITIVE scopes require ' 'Google OAuth App Verification before ' 'production use. RESTRICTED-scope data stored ' 'or transmitted on servers additionally ' 'requires a security assessment.', 'default_scope_request': 'https://www.googleapis.com/auth/gmail.modify'}}, 'ads': { 'id': 'ads', 'api': 'Google Ads API', 'version': 'v19', 'base_url': 'https://googleads.googleapis.com', 'batch_endpoint': None, 'auth_model': 'Google OAuth 2.0 + developer token', 'scope_required': True, 'generated': '2026-08-02', 'docs_url': 'https://developers.google.com/google-ads/api/docs/oauth/overview', 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires only ' 'basic OAuth App Verification.', 'sensitive': 'Provides access to specific Google user data that ' 'users authorize. Requires additional OAuth App ' 'Verification.', 'restricted': 'Provides wide access to Google user data. Requires ' 'restricted-scope verification and (if ' 'stored/transmitted on servers) a security ' 'assessment.'}, 'scopes': [ { 'name': 'adwords', 'uri': 'https://www.googleapis.com/auth/adwords', 'description': 'See and manage your Google Ads accounts.', 'permission_level': 'restricted', 'required': True, 'recommended': True, 'reason': 'The sole scope used by the Google Ads API. All Google Ads API calls ' 'require this scope plus a valid developer token.', 'least_privilege_recommendation': 'Always request. There is no narrower alternative ' 'for Google Ads API access.'}, { 'name': 'admanager.readonly', 'uri': 'https://www.googleapis.com/auth/admanager.readonly', 'description': 'See and manage your Google Ad Manager data (read-only).', 'permission_level': 'restricted', 'required': False, 'recommended': False, 'reason': 'For Google Ad Manager (DoubleClick) integrations; not needed for Google ' 'Ads API.', 'least_privilege_recommendation': 'Request only when the integration also touches ' 'Ad Manager.'}], 'recommended_combinations': {'google_ads_api': ['https://www.googleapis.com/auth/adwords']}, 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, 'refresh_token_unused_invalidates_after_months': 6, 'max_refresh_tokens_per_account_per_client': 100, 'developer_token': 'In addition to OAuth scopes, every request requires a ' 'Google Ads developer token issued by the Google Ads API ' 'center. The token and OAuth consent are managed in the ' 'API center.', 'verification_requirement': 'The adwords scope is RESTRICTED and requires ' 'restricted-scope OAuth App Verification and a ' 'security assessment.', 'default_scope_request': 'https://www.googleapis.com/auth/adwords'}}}