diff --git "a/app/services/google_scopes_data.py" "b/app/services/google_scopes_data.py" new file mode 100644--- /dev/null +++ "b/app/services/google_scopes_data.py" @@ -0,0 +1,1357 @@ +from __future__ import annotations + +from typing import Any, Dict + +# Google per-API scope catalog as an in-memory Python data structure. +# Source of truth: app/services/google_scopes_data.py (no JSON files). +# Permission levels: "non-sensitive" | "sensitive" | "restricted". + +GOOGLE_APIS: Dict[str, Dict[str, Any]] = { 'maps_static': { 'id': 'maps_static', + 'api': 'Google Maps Static API', + 'version': 'v1', + 'base_url': 'https://maps.googleapis.com/maps/api/staticmap', + 'batch_endpoint': None, + 'auth_model': 'API Key (no OAuth)', + 'scope_required': False, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/maps/documentation/maps-static/overview', + 'info': 'Authenticates with a server-side API key only (optionally URL-signed). No OAuth ' + 'scopes are required.', + 'scopes': [], + 'recommended_combinations': {}, + 'production_notes': { 'key_restriction': 'Restrict the API key by IP address in Google ' + 'Cloud Console > APIs & Services > Credentials.', + 'billing_required': True, + 'signature': 'Use a digital signature (signing secret) when URL ' + 'usage is visible to end users.'}}, + 'places': { 'id': 'places', + 'api': 'Google Places API', + 'version': 'v1', + 'base_url': 'https://places.googleapis.com/v1', + 'batch_endpoint': None, + 'auth_model': 'API Key (no OAuth)', + 'scope_required': False, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/maps/documentation/places/web-service/overview', + 'info': 'Authenticates with an API key. The new Places API also supports OAuth bearer tokens, ' + 'but it is not required and no dedicated user-data scopes exist. API-key ' + 'authentication is the standard path.', + 'scopes': [], + 'recommended_combinations': {}, + 'production_notes': { 'key_restriction': 'Restrict the API key by IP address and allowed ' + 'Google Maps APIs.', + 'billing_required': True, + 'oauth_optional': 'Requests can alternatively carry an OAuth access ' + 'token in the Authorization header, but no user-data ' + 'scopes are defined for Places.'}}, + 'geocoding': { 'id': 'geocoding', + 'api': 'Google Geocoding API', + 'version': 'v1', + 'base_url': 'https://maps.googleapis.com/maps/api/geocode', + 'batch_endpoint': None, + 'auth_model': 'API Key (no OAuth)', + 'scope_required': False, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/maps/documentation/geocoding/overview', + 'info': 'Authenticates with an API key. No OAuth scopes are required.', + 'scopes': [], + 'recommended_combinations': {}, + 'production_notes': { 'key_restriction': 'Restrict the API key by IP address and allowed ' + 'Google Maps APIs.', + 'billing_required': True}}, + 'gemini': { 'id': 'gemini', + 'api': 'Google Gemini API (public)', + 'version': 'v1beta', + 'base_url': 'https://generativelanguage.googleapis.com/v1beta', + 'batch_endpoint': None, + 'auth_model': 'API Key (no OAuth)', + 'scope_required': False, + 'generated': '2026-08-02', + 'docs_url': 'https://ai.google.dev/gemini-api/docs', + 'info': 'Authenticates with an API key via the X-Goog-Api-Key header or key query parameter. ' + 'No OAuth scopes are required.', + 'scopes': [], + 'recommended_combinations': {}, + 'production_notes': { 'key_restriction': 'Restrict the API key to the Generative Language API ' + 'in Google Cloud Console.', + 'billing_required': False, + 'free_tier': 'The public Gemini API has a free tier; higher quotas ' + 'require billing.'}}, + 'cloud_ai': { 'id': 'cloud_ai', + 'api': 'Google Cloud AI (Vision, Translate)', + 'version': 'v1', + 'base_url': 'https://vision.googleapis.com/v1', + 'batch_endpoint': None, + 'auth_model': 'API Key or Service Account (no user OAuth)', + 'scope_required': False, + 'generated': '2026-08-02', + 'docs_url': 'https://cloud.google.com/docs/authentication', + 'info': 'Vision and Translate use either an API key or a service account for authentication. ' + 'No user OAuth scopes are required. If an end-user OAuth flow is ever used instead, ' + 'the broad cloud-platform scope applies, but it is not needed for the standard ' + 'API-key/service-account path.', + 'scopes': [], + 'recommended_combinations': {}, + 'production_notes': { 'key_restriction': 'Restrict the API key to the Cloud Vision and Cloud ' + 'Translation APIs.', + 'service_account': 'Preferred for server-to-server calls: attach the ' + 'service account to the instance or use an ' + 'ADC-signed token.', + 'billing_required': True}}, + 'cloud_storage': { 'id': 'cloud_storage', + 'api': 'Google Cloud Storage', + 'version': 'v1', + 'base_url': 'https://storage.googleapis.com/storage/v1', + 'batch_endpoint': None, + 'auth_model': 'Service Account (no user OAuth)', + 'scope_required': False, + 'generated': '2026-08-02', + 'docs_url': 'https://cloud.google.com/storage/docs/authentication', + 'info': 'Authenticates with a service account (application-default credentials) or a ' + 'signed URL. No user OAuth scopes are required. The legacy devstorage scopes ' + 'exist only for end-user OAuth flows and are not needed here.', + 'scopes': [], + 'recommended_combinations': {}, + 'production_notes': { 'service_account': 'Grant the service account the Storage Object ' + 'Admin / Storage Object Viewer roles on the ' + 'target buckets.', + 'signed_urls': 'Use query-parameter signatures for time-limited ' + 'public download/upload URLs.', + 'billing_required': True}}, + 'oauth_signin': { 'id': 'oauth_signin', + 'api': 'Google OAuth 2.0 Sign-In (Identity / OIDC)', + 'version': 'oidc', + 'base_url': 'https://oauth2.googleapis.com', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (OpenID Connect)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/identity/openid-connect/openid-connect', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. ' + 'Requires only basic OAuth App ' + 'Verification.', + 'sensitive': 'Provides access to specific Google user ' + 'data that users authorize. Requires ' + 'additional OAuth App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification ' + 'and (if stored/transmitted on servers) a ' + 'security assessment.'}, + 'scopes': [ { 'name': 'openid', + 'uri': 'openid', + 'description': 'OpenID Connect authentication; returns the ID token with a ' + 'stable subject identifier (sub).', + 'permission_level': 'non-sensitive', + 'required': True, + 'recommended': True, + 'reason': 'Core OIDC scope; required to receive an id_token.', + 'least_privilege_recommendation': 'Always request. Keep it combined with ' + 'email and profile for basic identity.'}, + { 'name': 'email', + 'uri': 'https://www.googleapis.com/auth/userinfo.email', + 'description': 'See your primary Google Account email address.', + 'permission_level': 'non-sensitive', + 'required': True, + 'recommended': True, + 'reason': "Used to read the user's verified primary email address.", + 'least_privilege_recommendation': 'Request only when the app needs the ' + "user's email address for account " + 'mapping.'}, + { 'name': 'profile', + 'uri': 'https://www.googleapis.com/auth/userinfo.profile', + 'description': 'See your personal info, including any personal info you ' + 'have made publicly available.', + 'permission_level': 'non-sensitive', + 'required': True, + 'recommended': True, + 'reason': "Used to read the user's name, picture, locale and other profile " + 'fields.', + 'least_privilege_recommendation': 'Request only when the app needs profile ' + 'display data.'}, + { 'name': 'userinfo.email', + 'uri': 'https://www.googleapis.com/auth/userinfo.email', + 'description': 'See your primary Google Account email address (legacy ' + 'alias of email).', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Legacy duplicate of the email scope.', + 'least_privilege_recommendation': 'Prefer the openid/email/profile ' + 'combination; avoid requesting the ' + 'legacy alias twice.'}, + { 'name': 'userinfo.profile', + 'uri': 'https://www.googleapis.com/auth/userinfo.profile', + 'description': 'See your personal info (legacy alias of profile).', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Legacy duplicate of the profile scope.', + 'least_privilege_recommendation': 'Prefer the openid/email/profile ' + 'combination; avoid requesting the ' + 'legacy alias twice.'}], + 'recommended_combinations': { 'default': [ 'openid', + 'https://www.googleapis.com/auth/userinfo.email', + 'https://www.googleapis.com/auth/userinfo.profile']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'None of these scopes are ' + 'sensitive/restricted, so only basic ' + 'OAuth App Verification is needed.', + 'default_scope_request': 'openid email profile'}}, + 'people': { 'id': 'people', + 'api': 'Google People API (Contacts)', + 'version': 'v1', + 'base_url': 'https://people.googleapis.com/v1', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/people/v1/contacts', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data ' + 'that users authorize. Requires additional OAuth ' + 'App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and (if ' + 'stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'contacts.readonly', + 'uri': 'https://www.googleapis.com/auth/contacts.readonly', + 'description': 'Read all of your Google Contacts.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'Core read capability for contact automation: list/get contacts, ' + 'contact groups and search.', + 'least_privilege_recommendation': 'Default scope for reading contacts. Upgrade ' + 'to contacts (read/write) only when the app ' + 'must create or modify contacts.'}, + { 'name': 'contacts', + 'uri': 'https://www.googleapis.com/auth/contacts', + 'description': 'Read, write, and manage your contacts.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Read/write access to the user's entire contact list.", + 'least_privilege_recommendation': 'Request only when creating/editing/deleting ' + 'contacts is a hard requirement; otherwise ' + 'stay read-only.'}, + { 'name': 'contacts.other.readonly', + 'uri': 'https://www.googleapis.com/auth/contacts.other.readonly', + 'description': 'Read the contact information of other people that a given ' + 'contact has shared with you.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Access to a contact's 'other contacts' (secondary people).", + 'least_privilege_recommendation': 'Rarely needed; omit unless the app must read ' + "a contact's own address book."}, + { 'name': 'directory.readonly', + 'uri': 'https://www.googleapis.com/auth/directory.readonly', + 'description': 'Read the list of people in your domain (Google Workspace ' + 'directory).', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Company directory access; only meaningful for Google Workspace ' + 'domains.', + 'least_privilege_recommendation': 'Request only for Workspace directory use ' + 'cases; requires a Workspace admin to grant ' + 'access.'}], + 'recommended_combinations': { 'read_only': [ 'https://www.googleapis.com/auth/contacts.readonly'], + 'read_write': ['https://www.googleapis.com/auth/contacts']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'All contacts scopes are RESTRICTED and ' + 'require restricted-scope OAuth App ' + 'Verification and a security assessment if ' + 'data is stored/transmitted on servers.', + 'default_scope_request': 'https://www.googleapis.com/auth/contacts.readonly'}}, + 'calendar': { 'id': 'calendar', + 'api': 'Google Calendar API', + 'version': 'v3', + 'base_url': 'https://www.googleapis.com/calendar/v3', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/calendar/api/auth', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data ' + 'that users authorize. Requires additional ' + 'OAuth App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and ' + '(if stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'calendar.events', + 'uri': 'https://www.googleapis.com/auth/calendar.events', + 'description': 'See, edit, share, and permanently delete the calendars you can ' + 'access using Google Calendar.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'Core read/write for events (create/update/delete events) without ' + 'exposing calendar settings or the full ACL model.', + 'least_privilege_recommendation': 'Default scope for event automation. Prefer ' + 'calendar.events.readonly when the app never ' + 'writes events.'}, + { 'name': 'calendar.events.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.events.readonly', + 'description': 'View events on all your calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to events across all calendars.', + 'least_privilege_recommendation': 'Use for read-only event automation ' + '(scheduling checks, availability).'}, + { 'name': 'calendar.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.readonly', + 'description': 'See and download any calendar you can access using your Google ' + 'Calendar.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to calendars including metadata and events.', + 'least_privilege_recommendation': 'Use when the app needs to read calendar ' + 'metadata and settings, not just events.'}, + { 'name': 'calendar', + 'uri': 'https://www.googleapis.com/auth/calendar', + 'description': 'See, edit, share, and permanently delete the calendars you can ' + 'access using Google Calendar.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Full access to all Calendar functionality including sharing and ' + 'ACLs.', + 'least_privilege_recommendation': 'Avoid. calendar.events + ' + 'calendar.settings.readonly cover most ' + 'automation with a smaller surface.'}, + { 'name': 'calendar.freebusy', + 'uri': 'https://www.googleapis.com/auth/calendar.freebusy', + 'description': 'See free/busy availability for attendees and calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Only returns busy/free blocks, never event details.', + 'least_privilege_recommendation': 'Use for availability checks that must not ' + 'expose event content.'}, + { 'name': 'calendar.settings.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.settings.readonly', + 'description': "See your primary account's Calendar settings.", + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Read-only access to the user's calendar settings (timezone, working " + 'hours).', + 'least_privilege_recommendation': 'Request alongside calendar.events only if ' + 'settings/working-hours are needed.'}, + { 'name': 'calendar.calendarlist.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.calendarlist.readonly', + 'description': 'View calendars you own or subscribe to.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Lists the user's calendar subscriptions and their visibility/color " + 'metadata.', + 'least_privilege_recommendation': 'Use when the app must enumerate subscribed ' + 'calendars without full read/write.'}, + { 'name': 'calendar.calendarlist', + 'uri': 'https://www.googleapis.com/auth/calendar.calendarlist', + 'description': 'See, edit, and delete your Google Calendar lists.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Manage the user's calendar list (add/remove subscribed calendars).", + 'least_privilege_recommendation': 'Request only when the app manages calendar ' + 'subscriptions.'}, + { 'name': 'calendar.calendars.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.calendars.readonly', + 'description': 'View your Calendar events and details.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to calendar metadata (name, description, ' + 'timezone).', + 'least_privilege_recommendation': 'Narrower than calendar.readonly; use when ' + 'only calendar-level metadata is needed.'}, + { 'name': 'calendar.calendars', + 'uri': 'https://www.googleapis.com/auth/calendar.calendars', + 'description': 'View and edit the metadata of your calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write calendar metadata without event or ACL access.', + 'least_privilege_recommendation': 'Request only when the app edits calendar ' + 'metadata.'}, + { 'name': 'calendar.acls.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.acls.readonly', + 'description': 'See who has access to your calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to calendar sharing rules.', + 'least_privilege_recommendation': 'Request only for sharing/visibility ' + 'audits.'}, + { 'name': 'calendar.acls', + 'uri': 'https://www.googleapis.com/auth/calendar.acls', + 'description': 'See, edit, and share your calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write calendar sharing (ACL) rules.', + 'least_privilege_recommendation': 'Request only when the app manages calendar ' + 'sharing.'}, + { 'name': 'calendar.events.owned.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.events.owned.readonly', + 'description': 'See the events you own.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to events the user owns (not events shared with ' + 'them).', + 'least_privilege_recommendation': 'Narrower read option when the app only ' + "needs the user's own events."}, + { 'name': 'calendar.events.owned', + 'uri': 'https://www.googleapis.com/auth/calendar.events.owned', + 'description': 'See, edit, share, and permanently delete the calendars you can ' + 'access using Google Calendar (own events).', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write for events the user owns.', + 'least_privilege_recommendation': 'Use when the app only manages events ' + 'created by the user.'}, + { 'name': 'calendar.app.created', + 'uri': 'https://www.googleapis.com/auth/calendar.app.created', + 'description': 'Create and manage events on secondary calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Creates events in secondary calendars for the app.', + 'least_privilege_recommendation': 'Request only when the app needs its own ' + 'secondary calendar.'}, + { 'name': 'calendar.events.public.readonly', + 'uri': 'https://www.googleapis.com/auth/calendar.events.public.readonly', + 'description': 'View public events on all your calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to public events only.', + 'least_privilege_recommendation': 'Use only when the app strictly needs public ' + 'event data.'}, + { 'name': 'calendar.events.freebusy', + 'uri': 'https://www.googleapis.com/auth/calendar.events.freebusy', + 'description': 'View free/busy information for your calendars.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Free/busy only, without event details.', + 'least_privilege_recommendation': 'Similar to calendar.freebusy; use the ' + 'narrower single scope.'}, + { 'name': 'calendar.addons.execute', + 'uri': 'https://www.googleapis.com/auth/calendar.addons.execute', + 'description': 'Run your add-on (Calendar add-on runtime).', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Required to run a Calendar add-on; not needed for server-side ' + 'automation.', + 'least_privilege_recommendation': 'Skip for backend automation.'}, + { 'name': 'calendar.addons.current.event.read', + 'uri': 'https://www.googleapis.com/auth/calendar.addons.current.event.read', + 'description': 'See the event details of the calendar event where the add-on ' + 'is displayed.', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Reads the event the add-on card is attached to.', + 'least_privilege_recommendation': 'Skip for backend automation; add-on context ' + 'only.'}, + { 'name': 'calendar.addons.current.event.write', + 'uri': 'https://www.googleapis.com/auth/calendar.addons.current.event.write', + 'description': 'See, edit, share, and permanently delete the event where the ' + 'add-on is displayed.', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Writes the event the add-on card is attached to.', + 'least_privilege_recommendation': 'Skip for backend automation; add-on context ' + 'only.'}], + 'recommended_combinations': { 'read_only_events': [ 'https://www.googleapis.com/auth/calendar.events.readonly'], + 'event_crud': [ 'https://www.googleapis.com/auth/calendar.events'], + 'availability_only': [ 'https://www.googleapis.com/auth/calendar.freebusy'], + 'full_calendar': ['https://www.googleapis.com/auth/calendar']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'Most calendar scopes are RESTRICTED and ' + 'require restricted-scope OAuth App ' + 'Verification and a security assessment if ' + 'data is stored/transmitted on servers.', + 'default_scope_request': 'https://www.googleapis.com/auth/calendar.events'}}, + 'sheets': { 'id': 'sheets', + 'api': 'Google Sheets API', + 'version': 'v4', + 'base_url': 'https://sheets.googleapis.com/v4', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/workspace/sheets/api/scopes', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data ' + 'that users authorize. Requires additional OAuth ' + 'App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and (if ' + 'stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'drive.file', + 'uri': 'https://www.googleapis.com/auth/drive.file', + 'description': 'See, edit, create, and delete only the specific Google Drive ' + 'files you use with this app.', + 'permission_level': 'non-sensitive', + 'required': True, + 'recommended': True, + 'reason': 'Per-file access scoped to spreadsheets the user opened/created with ' + "the app. Google's recommended minimal scope for Sheets.", + 'least_privilege_recommendation': 'Default scope for spreadsheet automation. ' + 'Request it before spreadsheets to keep the ' + 'risk surface minimal.'}, + { 'name': 'spreadsheets.readonly', + 'uri': 'https://www.googleapis.com/auth/spreadsheets.readonly', + 'description': 'See all your Google Sheets spreadsheets.', + 'permission_level': 'sensitive', + 'required': False, + 'recommended': False, + 'reason': "Read-only access to all spreadsheets in the user's Drive.", + 'least_privilege_recommendation': 'Use for read-only spreadsheet automation that ' + 'must address files by URL.'}, + { 'name': 'spreadsheets', + 'uri': 'https://www.googleapis.com/auth/spreadsheets', + 'description': 'See, edit, create, and delete all of your Google Sheets files.', + 'permission_level': 'sensitive', + 'required': False, + 'recommended': False, + 'reason': "Read/write access to all spreadsheets in the user's Drive.", + 'least_privilege_recommendation': 'Request only when the app must address any ' + 'spreadsheet by URL and drive.file is ' + 'insufficient.'}, + { 'name': 'drive.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.readonly', + 'description': 'See and download all your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Broad read access to the entire Drive, including spreadsheets.', + 'least_privilege_recommendation': 'Avoid unless the app needs other Drive file ' + 'types alongside sheets.'}, + { 'name': 'drive', + 'uri': 'https://www.googleapis.com/auth/drive', + 'description': 'See, edit, create, and delete all of your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Full read/write access to the entire Drive.', + 'least_privilege_recommendation': 'Avoid. Prefer drive.file or spreadsheets.'}], + 'recommended_combinations': { 'per_file_automation': [ 'https://www.googleapis.com/auth/drive.file'], + 'read_only_by_url': [ 'https://www.googleapis.com/auth/spreadsheets.readonly'], + 'read_write_by_url': [ 'https://www.googleapis.com/auth/spreadsheets']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'spreadsheets/spreadsheets.readonly are ' + 'SENSITIVE; drive and drive.readonly are ' + 'RESTRICTED and require restricted-scope ' + 'verification.', + 'default_scope_request': 'https://www.googleapis.com/auth/drive.file'}}, + 'youtube': { 'id': 'youtube', + 'api': 'YouTube Data API', + 'version': 'v3', + 'base_url': 'https://www.googleapis.com/youtube/v3', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/youtube/v3/guides/auth', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data ' + 'that users authorize. Requires additional OAuth ' + 'App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and (if ' + 'stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'youtube.readonly', + 'uri': 'https://www.googleapis.com/auth/youtube.readonly', + 'description': 'See a list of your YouTube videos and playlists and related ' + 'information such as view counts, comments, and ratings.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'Core read capability for channel/video metadata, playlists, comments ' + 'and search.', + 'least_privilege_recommendation': 'Default scope for read-only YouTube ' + 'automation.'}, + { 'name': 'youtube.upload', + 'uri': 'https://www.googleapis.com/auth/youtube.upload', + 'description': 'Manage your YouTube videos.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Upload videos to the user's channel. No read access to channel data.", + 'least_privilege_recommendation': 'Use for upload pipelines that do not need to ' + 'read channel metadata.'}, + { 'name': 'youtube.force-ssl', + 'uri': 'https://www.googleapis.com/auth/youtube.force-ssl', + 'description': 'See, edit, and permanently delete your YouTube videos, ratings, ' + 'comments and captions.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write for videos, ratings, comments, captions and playlists.', + 'least_privilege_recommendation': 'Request when the app must edit or delete ' + 'content; combine with youtube.upload for ' + 'uploads.'}, + { 'name': 'youtube', + 'uri': 'https://www.googleapis.com/auth/youtube', + 'description': 'Manage your YouTube account.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Full account management, including channel settings.', + 'least_privilege_recommendation': 'Avoid unless account-level management is ' + 'required.'}, + { 'name': 'youtube.channel-memberships.creator', + 'uri': 'https://www.googleapis.com/auth/youtube.channel-memberships.creator', + 'description': 'See a list of your current active channel members, their ' + 'current level, and when they became a member.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to channel membership data.', + 'least_privilege_recommendation': 'Request only for creator membership ' + 'analytics.'}, + { 'name': 'youtubepartner', + 'uri': 'https://www.googleapis.com/auth/youtubepartner', + 'description': 'View and manage your assets and associated content on YouTube.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'YouTube Partner Program asset/content management.', + 'least_privilege_recommendation': 'Request only for partner/MCN integrations.'}, + { 'name': 'youtubepartner-channel-audit', + 'uri': 'https://www.googleapis.com/auth/youtubepartner-channel-audit', + 'description': 'View private information of your YouTube channel relevant ' + 'during the audit process with a YouTube partner.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Channel audit data used by partners.', + 'least_privilege_recommendation': 'Request only for partner audit workflows.'}], + 'recommended_combinations': { 'read_only': [ 'https://www.googleapis.com/auth/youtube.readonly'], + 'upload_only': [ 'https://www.googleapis.com/auth/youtube.upload'], + 'read_write': [ 'https://www.googleapis.com/auth/youtube.force-ssl'], + 'read_write_and_upload': [ 'https://www.googleapis.com/auth/youtube.force-ssl', + 'https://www.googleapis.com/auth/youtube.upload']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'All YouTube scopes are RESTRICTED and ' + 'require restricted-scope OAuth App ' + 'Verification and a security assessment if ' + 'data is stored/transmitted on servers.', + 'default_scope_request': 'https://www.googleapis.com/auth/youtube.readonly'}}, + 'drive': { 'id': 'drive', + 'api': 'Google Drive API', + 'version': 'v3', + 'base_url': 'https://www.googleapis.com/drive/v3', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/workspace/drive/api/guides/api-specific-auth', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data that ' + 'users authorize. Requires additional OAuth App ' + 'Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and (if ' + 'stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'drive.file', + 'uri': 'https://www.googleapis.com/auth/drive.file', + 'description': 'See, edit, create, and delete only the specific Google Drive ' + 'files you use with this app.', + 'permission_level': 'non-sensitive', + 'required': True, + 'recommended': True, + 'reason': "Google's recommended default: per-file access limited to files the app " + 'created or opened.', + 'least_privilege_recommendation': 'Default scope for Drive automation. Upgrade ' + 'only when the app must address arbitrary files ' + 'by ID/URL.'}, + { 'name': 'drive.metadata.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.metadata.readonly', + 'description': 'See information about your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to file metadata (name, mimeType, parents) without ' + 'content.', + 'least_privilege_recommendation': 'Use for indexing/listing that does not need ' + "file content. Google's recommended minimal " + 'metadata scope.'}, + { 'name': 'drive.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.readonly', + 'description': 'See and download all your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to all files and their content.', + 'least_privilege_recommendation': 'Use for read-only automation addressing files ' + 'by ID/URL.'}, + { 'name': 'drive', + 'uri': 'https://www.googleapis.com/auth/drive', + 'description': 'See, edit, create, and delete all of your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Full read/write access to the entire Drive.', + 'least_privilege_recommendation': 'Avoid. Prefer drive.file whenever possible.'}, + { 'name': 'drive.metadata', + 'uri': 'https://www.googleapis.com/auth/drive.metadata', + 'description': 'See, edit, create, and delete only the specific Google Drive ' + 'files you use with this app (metadata only).', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write file metadata only, no content.', + 'least_privilege_recommendation': 'Rarely needed; request only when metadata must ' + 'be modified.'}, + { 'name': 'drive.appdata', + 'uri': 'https://www.googleapis.com/auth/drive.appdata', + 'description': 'View and manage its own configuration data in your Google Drive.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': "Access only to the app's private appdata folder.", + 'least_privilege_recommendation': 'Request only when using the Drive appdata ' + 'folder for per-user config.'}, + { 'name': 'drive.apps.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.apps.readonly', + 'description': "See and download your application's data using Google Drive.", + 'permission_level': 'sensitive', + 'required': False, + 'recommended': False, + 'reason': "Read-only access to the app's own data in Drive.", + 'least_privilege_recommendation': 'Request only when the app must access files it ' + 'created in Drive.'}, + { 'name': 'drive.scripts', + 'uri': 'https://www.googleapis.com/auth/drive.scripts', + 'description': 'See, edit, create, and delete your scripts in Google Apps Script.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Access to Apps Script projects.', + 'least_privilege_recommendation': 'Request only for Apps Script management.'}, + { 'name': 'drive.install', + 'uri': 'https://www.googleapis.com/auth/drive.install', + 'description': 'Add or remove yourself as an editor of documents your app opens.', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': "Used with the Drive UI 'Open with' flow.", + 'least_privilege_recommendation': 'Request only when integrating with the Drive ' + 'web UI.'}, + { 'name': 'drive.activity', + 'uri': 'https://www.googleapis.com/auth/drive.activity', + 'description': 'View the activity history of your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write visibility into Drive activity history.', + 'least_privilege_recommendation': 'Request only for audit/activity features.'}, + { 'name': 'drive.activity.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.activity.readonly', + 'description': 'View the activity history of your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to Drive activity history.', + 'least_privilege_recommendation': 'Prefer this over drive.activity when no writes ' + 'are needed.'}, + { 'name': 'drive.photos.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.photos.readonly', + 'description': 'View the files and photos in your Google Photos library.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to the Google Photos library.', + 'least_privilege_recommendation': 'Request only for Google Photos integration.'}, + { 'name': 'drive.meet.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.meet.readonly', + 'description': 'See and download all your Google Meet recordings saved to Google ' + 'Drive.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to Meet recordings stored in Drive.', + 'least_privilege_recommendation': 'Request only for Meet recording workflows.'}], + 'recommended_combinations': { 'per_file_automation': [ 'https://www.googleapis.com/auth/drive.file'], + 'metadata_only': [ 'https://www.googleapis.com/auth/drive.metadata.readonly'], + 'read_only_by_id': [ 'https://www.googleapis.com/auth/drive.readonly'], + 'full_drive': ['https://www.googleapis.com/auth/drive']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'drive.file and drive.install are ' + 'NON-SENSITIVE; drive.apps.readonly is ' + 'SENSITIVE; the remaining scopes are ' + 'RESTRICTED and require restricted-scope ' + 'verification.', + 'default_scope_request': 'https://www.googleapis.com/auth/drive.file'}}, + 'admin_sdk': { 'id': 'admin_sdk', + 'api': 'Google Workspace Admin SDK (Directory & Reports)', + 'version': 'directory_v1 / reports_v1', + 'base_url': 'https://admin.googleapis.com/admin', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 (typically domain-wide delegation via a service account)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/workspace/admin/directory/v1/guides/authorize', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data ' + 'that users authorize. Requires additional ' + 'OAuth App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and ' + '(if stored/transmitted on servers) a ' + 'security assessment.'}, + 'scopes': [ { 'name': 'admin.directory.user.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.user.readonly', + 'description': 'See information about users on your domain.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'Core read capability for directory user management.', + 'least_privilege_recommendation': 'Default read scope for user directory ' + 'automation.'}, + { 'name': 'admin.directory.user', + 'uri': 'https://www.googleapis.com/auth/admin.directory.user', + 'description': 'See, edit, configure, and delete your Google Account.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write user lifecycle management (create, suspend, delete ' + 'users).', + 'least_privilege_recommendation': 'Request only when the app must ' + 'create/update/delete users.'}, + { 'name': 'admin.directory.group.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.group.readonly', + 'description': 'See information about groups on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to group metadata.', + 'least_privilege_recommendation': 'Use for read-only group listing.'}, + { 'name': 'admin.directory.group', + 'uri': 'https://www.googleapis.com/auth/admin.directory.group', + 'description': 'See, edit, create, and delete all of your Google Group ' + 'subscriptions.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write group management.', + 'least_privilege_recommendation': 'Request only when the app manages groups.'}, + { 'name': 'admin.directory.group.member.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.group.member.readonly', + 'description': 'See information about members of groups on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to group memberships.', + 'least_privilege_recommendation': 'Use for read-only membership listing.'}, + { 'name': 'admin.directory.group.member', + 'uri': 'https://www.googleapis.com/auth/admin.directory.group.member', + 'description': 'See, edit, and manage membership of groups on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write group membership management.', + 'least_privilege_recommendation': 'Request only when the app adds/removes ' + 'group members.'}, + { 'name': 'admin.directory.device.chromeos.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly', + 'description': 'See information about your ChromeOS devices.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only ChromeOS device inventory.', + 'least_privilege_recommendation': 'Request only for device inventory ' + 'reporting.'}, + { 'name': 'admin.directory.device.chromeos', + 'uri': 'https://www.googleapis.com/auth/admin.directory.device.chromeos', + 'description': 'See, edit, configure, and delete your ChromeOS devices.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write ChromeOS device management.', + 'least_privilege_recommendation': 'Request only when managing ChromeOS ' + 'devices.'}, + { 'name': 'admin.directory.orgunit.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.orgunit.readonly', + 'description': 'See information about organizational units on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to organizational units.', + 'least_privilege_recommendation': 'Request only for OU-aware reporting.'}, + { 'name': 'admin.directory.orgunit', + 'uri': 'https://www.googleapis.com/auth/admin.directory.orgunit', + 'description': 'See, edit, and configure organizational units on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write OU management.', + 'least_privilege_recommendation': 'Request only when managing organizational ' + 'units.'}, + { 'name': 'admin.directory.rolemanagement.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly', + 'description': 'See information about roles on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to admin roles.', + 'least_privilege_recommendation': 'Request only for role auditing.'}, + { 'name': 'admin.directory.rolemanagement', + 'uri': 'https://www.googleapis.com/auth/admin.directory.rolemanagement', + 'description': 'See, edit, and manage admin roles on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write admin role assignments.', + 'least_privilege_recommendation': 'Request only when managing admin roles.'}, + { 'name': 'admin.directory.domain.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.domain.readonly', + 'description': 'See information about domains on your account.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to domain settings.', + 'least_privilege_recommendation': 'Request only when domain metadata is ' + 'needed.'}, + { 'name': 'admin.directory.customer.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.customer.readonly', + 'description': 'See information about your Google Workspace account.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to customer/account settings.', + 'least_privilege_recommendation': 'Request only when account-level metadata ' + 'is needed.'}, + { 'name': 'admin.directory.userschema.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.directory.userschema.readonly', + 'description': 'See information about custom user schemas on your domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to custom schema definitions.', + 'least_privilege_recommendation': 'Request only when reading custom user ' + 'attributes.'}, + { 'name': 'admin.reports.audit.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.reports.audit.readonly', + 'description': 'View audit reports for your Google Workspace domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to admin audit logs.', + 'least_privilege_recommendation': 'Request only for audit/reporting ' + 'features.'}, + { 'name': 'admin.reports.usage.readonly', + 'uri': 'https://www.googleapis.com/auth/admin.reports.usage.readonly', + 'description': 'View usage reports for your Google Workspace domain.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access to usage metrics.', + 'least_privilege_recommendation': 'Request only for usage analytics.'}, + { 'name': 'admin.datatransfer', + 'uri': 'https://www.googleapis.com/auth/admin.datatransfer', + 'description': 'Manage the transfer of data between user accounts.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Performs/administers data-transfer requests between users.', + 'least_privilege_recommendation': 'Request only for user data-transfer ' + 'workflows.'}], + 'recommended_combinations': { 'directory_read_users': [ 'https://www.googleapis.com/auth/admin.directory.user.readonly'], + 'directory_full_users': [ 'https://www.googleapis.com/auth/admin.directory.user'], + 'groups_read': [ 'https://www.googleapis.com/auth/admin.directory.group.readonly', + 'https://www.googleapis.com/auth/admin.directory.group.member.readonly'], + 'reports': [ 'https://www.googleapis.com/auth/admin.reports.audit.readonly']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'delegation': 'Admin APIs are normally called with domain-wide ' + 'delegation from a service account using a Workspace ' + 'super-admin account; the OAuth user flow only works ' + 'for users with admin privileges.', + 'verification_requirement': 'All admin.directory and admin.reports ' + 'scopes are RESTRICTED and require ' + 'restricted-scope verification and a ' + 'security assessment.', + 'default_scope_request': 'https://www.googleapis.com/auth/admin.directory.user.readonly'}}, + 'bigquery': { 'id': 'bigquery', + 'api': 'Google BigQuery API', + 'version': 'v2', + 'base_url': 'https://bigquery.googleapis.com/bigquery/v2', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 or Service Account (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://cloud.google.com/bigquery/docs/authentication', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data ' + 'that users authorize. Requires additional ' + 'OAuth App Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope verification and ' + '(if stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'bigquery.readonly', + 'uri': 'https://www.googleapis.com/auth/bigquery.readonly', + 'description': 'View your data in Google BigQuery.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'Read-only access to datasets, tables, and query results.', + 'least_privilege_recommendation': 'Default scope for analytics/reporting. ' + 'Upgrade to bigquery only when the app must ' + 'write or manage data.'}, + { 'name': 'bigquery', + 'uri': 'https://www.googleapis.com/auth/bigquery', + 'description': 'View and manage your data in Google BigQuery.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read/write/delete data, datasets and jobs.', + 'least_privilege_recommendation': 'Request only when the app inserts data, ' + 'manages tables/datasets, or runs DDL/DML.'}, + { 'name': 'bigquery.insertdata', + 'uri': 'https://www.googleapis.com/auth/bigquery.insertdata', + 'description': 'Insert data into your Google BigQuery tables.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Insert-only (streaming/bulk insert) without the ability to modify ' + 'schema.', + 'least_privilege_recommendation': 'Use for ingest-only pipelines.'}, + { 'name': 'cloud-platform', + 'uri': 'https://www.googleapis.com/auth/cloud-platform', + 'description': 'See, edit, configure, and delete your Google Cloud data and ' + 'see the email address for your Google Account.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Broad access to all Google Cloud resources for the signed-in user.', + 'least_privilege_recommendation': 'Avoid for user OAuth; use it only as a ' + 'fallback when the app is itself a GCP ' + 'management tool.'}, + { 'name': 'cloud-platform.read-only', + 'uri': 'https://www.googleapis.com/auth/cloud-platform.read-only', + 'description': 'View your data across Google Cloud Platform services.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Read-only access across GCP services.', + 'least_privilege_recommendation': 'Prefer the narrower bigquery.readonly ' + 'scope.'}, + { 'name': 'devstorage.read_only', + 'uri': 'https://www.googleapis.com/auth/devstorage.read_only', + 'description': 'View your data in Google Cloud Storage.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Required to load data directly from files in Cloud Storage into ' + 'BigQuery.', + 'least_privilege_recommendation': 'Request only when jobs load from GCS ' + 'objects.'}, + { 'name': 'drive.readonly', + 'uri': 'https://www.googleapis.com/auth/drive.readonly', + 'description': 'See and download all your Google Drive files.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Required to query external tables that reference Google Drive files ' + '(e.g., Google Sheets).', + 'least_privilege_recommendation': 'Request only when querying Drive-backed ' + 'external tables.'}], + 'recommended_combinations': { 'read_only_analytics': [ 'https://www.googleapis.com/auth/bigquery.readonly'], + 'read_write': ['https://www.googleapis.com/auth/bigquery'], + 'ingest_only': [ 'https://www.googleapis.com/auth/bigquery.insertdata'], + 'load_from_gcs': [ 'https://www.googleapis.com/auth/bigquery', + 'https://www.googleapis.com/auth/devstorage.read_only']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'bigquery* and cloud-platform scopes are ' + 'RESTRICTED and require restricted-scope ' + 'verification and a security assessment.', + 'service_account': 'Server-to-server automation should prefer a ' + 'service account over user OAuth; the same scopes ' + 'are requested during impersonation.', + 'default_scope_request': 'https://www.googleapis.com/auth/bigquery.readonly'}}, + 'gmail': { 'id': 'gmail', + 'api': 'Gmail API', + 'version': 'v1', + 'base_url': 'https://gmail.googleapis.com/gmail/v1', + 'batch_endpoint': 'https://gmail.googleapis.com/batch/gmail/v1', + 'auth_model': 'Google OAuth 2.0 (stateless, client-supplied credentials)', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/gmail/api/auth/scopes', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires ' + 'only basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data that ' + 'users authorize. Requires additional OAuth App ' + 'Verification.', + 'restricted': 'Provides wide access to Google user data. ' + 'Requires restricted-scope OAuth App Verification ' + 'and (if data is stored/transmitted on servers) a ' + 'security assessment.'}, + 'scopes': [ { 'name': 'gmail.addons.current.action.compose', + 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.action.compose', + 'description': 'Manage drafts and send emails when you interact with the add-on.', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Only required for Gmail add-on context (cards running inside the Gmail ' + 'UI). Not needed for server-side mailbox automation.', + 'least_privilege_recommendation': 'Skip. Use gmail.compose (server-side) instead; ' + 'this scope only works inside the add-on ' + 'runtime.'}, + { 'name': 'gmail.addons.current.message.action', + 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.action', + 'description': 'View your email messages when you interact with the add-on.', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Add-on UI only. Useless for backend automation.', + 'least_privilege_recommendation': 'Skip. Use gmail.readonly or gmail.metadata ' + 'from a server context.'}, + { 'name': 'gmail.labels', + 'uri': 'https://www.googleapis.com/auth/gmail.labels', + 'description': 'See and edit your email labels.', + 'permission_level': 'non-sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Required only when the app must create/update/delete labels or manage ' + 'label-based inbox organization.', + 'least_privilege_recommendation': 'Request only when label CRUD is needed. If the ' + 'app only reads labels embedded in messages, ' + 'gmail.metadata suffices.'}, + { 'name': 'gmail.addons.current.message.metadata', + 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.metadata', + 'description': 'View your email message metadata when the add-on is running.', + 'permission_level': 'sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Add-on UI only.', + 'least_privilege_recommendation': 'Skip for server-side automation. Use ' + 'gmail.metadata.'}, + { 'name': 'gmail.addons.current.message.readonly', + 'uri': 'https://www.googleapis.com/auth/gmail.addons.current.message.readonly', + 'description': 'View your email messages when the add-on is running.', + 'permission_level': 'sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Add-on UI only.', + 'least_privilege_recommendation': 'Skip for server-side automation. Use ' + 'gmail.readonly.'}, + { 'name': 'gmail.send', + 'uri': 'https://www.googleapis.com/auth/gmail.send', + 'description': 'Send email on your behalf.', + 'permission_level': 'sensitive', + 'required': False, + 'recommended': False, + 'reason': 'Send-only automation (outbound notification engines) that never needs ' + 'to read the mailbox.', + 'least_privilege_recommendation': 'Use when the app sends email but does NOT need ' + 'to read the inbox. Pairs well with a separate ' + 'read scope if inbox reading is also needed.'}, + { 'name': 'gmail.compose', + 'uri': 'https://www.googleapis.com/auth/gmail.compose', + 'description': 'Manage drafts and send emails.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Draft-first workflows (approval flows) plus sending. Does not grant ' + 'read access to the inbox.', + 'least_privilege_recommendation': 'Choose over gmail.send when drafts must be ' + 'managed, but the app never reads inbox ' + 'messages.'}, + { 'name': 'gmail.metadata', + 'uri': 'https://www.googleapis.com/auth/gmail.metadata', + 'description': 'View your email message metadata such as labels and headers, but ' + 'not the email body.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Indexing/analytics that only needs headers and labels without message ' + 'bodies.', + 'least_privilege_recommendation': 'Strongly preferred over gmail.readonly when ' + 'body text is not required. Significantly ' + 'reduces data exposure.'}, + { 'name': 'gmail.readonly', + 'uri': 'https://www.googleapis.com/auth/gmail.readonly', + 'description': 'View your email messages and settings.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': False, + 'reason': 'Core read capability for mailbox automation: list/get messages, ' + 'threads, drafts, attachments, labels and settings. Cannot write.', + 'least_privilege_recommendation': 'Use for read-only automation. Combine with ' + 'gmail.modify only if the app must also change ' + 'labels/read state. Do NOT request when ' + 'gmail.metadata satisfies the requirement.'}, + { 'name': 'gmail.modify', + 'uri': 'https://www.googleapis.com/auth/gmail.modify', + 'description': 'Read, compose, and send emails from your Gmail account. This ' + 'scope does not allow immediate, permanent deletion of threads and ' + 'messages, bypassing the trash.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'End-to-end mailbox management: read, send, trash, label, modify read ' + "state, manage drafts/threads. The recommended 'full CRUD' scope " + 'because permanent delete stays behind trash.', + 'least_privilege_recommendation': 'Default scope for complete mailbox automation. ' + 'Prefer over https://mail.google.com/ whenever ' + 'possible; it covers all operations except ' + 'immediate permanent deletion.'}, + { 'name': 'gmail.insert', + 'uri': 'https://www.googleapis.com/auth/gmail.insert', + 'description': 'Add emails into your Gmail mailbox.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Mailbox migration, archiving, or importing historical messages.', + 'least_privilege_recommendation': 'Request only for import/migration flows. ' + 'Combined with gmail.readonly if the app also ' + 'reads existing mail.'}, + { 'name': 'gmail.settings.basic', + 'uri': 'https://www.googleapis.com/auth/gmail.settings.basic', + 'description': 'See, edit, create, or change your email settings and filters in ' + 'Gmail.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Automating mailbox configuration: filters, forwarding addresses, ' + 'vacation responders, IMAP/POP toggles.', + 'least_privilege_recommendation': 'Request only when the app manages mailbox ' + 'settings/filters. Otherwise omit to limit ' + 'scope.'}, + { 'name': 'gmail.settings.sharing', + 'uri': 'https://www.googleapis.com/auth/gmail.settings.sharing', + 'description': 'Manage your sensitive mail settings, including who can manage ' + 'your mail.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Granting/revoking mail delegation (Google Workspace). Operations ' + 'guarded by this scope are administrative and normally use domain-wide ' + 'delegation via a service account.', + 'least_privilege_recommendation': 'Request only for Workspace admin/delegation ' + 'use cases. Requires extra verification; not ' + 'needed for ordinary per-user automation.'}, + { 'name': 'mail.google.com', + 'uri': 'https://mail.google.com/', + 'description': 'Read, compose, send, and permanently delete all your email from ' + 'Gmail.', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'Only needed when the app must permanently delete threads/messages ' + 'immediately, bypassing trash.', + 'least_privilege_recommendation': 'Avoid. Request only when immediate permanent ' + 'deletion is a hard requirement; otherwise ' + 'gmail.modify covers everything else with a ' + 'much smaller risk surface.'}], + 'recommended_combinations': { 'read_only_automation': [ 'https://www.googleapis.com/auth/gmail.readonly'], + 'metadata_only_automation': [ 'https://www.googleapis.com/auth/gmail.metadata'], + 'full_mailbox_crud': [ 'https://www.googleapis.com/auth/gmail.modify', + 'https://www.googleapis.com/auth/gmail.send', + 'https://www.googleapis.com/auth/gmail.settings.basic'], + 'full_mailbox_crud_with_permanent_delete': [ 'https://mail.google.com/', + 'https://www.googleapis.com/auth/gmail.settings.basic'], + 'send_only': ['https://www.googleapis.com/auth/gmail.send']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'verification_requirement': 'RESTRICTED and SENSITIVE scopes require ' + 'Google OAuth App Verification before ' + 'production use. RESTRICTED-scope data stored ' + 'or transmitted on servers additionally ' + 'requires a security assessment.', + 'default_scope_request': 'https://www.googleapis.com/auth/gmail.modify'}}, + 'ads': { 'id': 'ads', + 'api': 'Google Ads API', + 'version': 'v19', + 'base_url': 'https://googleads.googleapis.com', + 'batch_endpoint': None, + 'auth_model': 'Google OAuth 2.0 + developer token', + 'scope_required': True, + 'generated': '2026-08-02', + 'docs_url': 'https://developers.google.com/google-ads/api/docs/oauth/overview', + 'classification_definitions': { 'non_sensitive': 'Smallest scope of authorization. Requires only ' + 'basic OAuth App Verification.', + 'sensitive': 'Provides access to specific Google user data that ' + 'users authorize. Requires additional OAuth App ' + 'Verification.', + 'restricted': 'Provides wide access to Google user data. Requires ' + 'restricted-scope verification and (if ' + 'stored/transmitted on servers) a security ' + 'assessment.'}, + 'scopes': [ { 'name': 'adwords', + 'uri': 'https://www.googleapis.com/auth/adwords', + 'description': 'See and manage your Google Ads accounts.', + 'permission_level': 'restricted', + 'required': True, + 'recommended': True, + 'reason': 'The sole scope used by the Google Ads API. All Google Ads API calls ' + 'require this scope plus a valid developer token.', + 'least_privilege_recommendation': 'Always request. There is no narrower alternative ' + 'for Google Ads API access.'}, + { 'name': 'admanager.readonly', + 'uri': 'https://www.googleapis.com/auth/admanager.readonly', + 'description': 'See and manage your Google Ad Manager data (read-only).', + 'permission_level': 'restricted', + 'required': False, + 'recommended': False, + 'reason': 'For Google Ad Manager (DoubleClick) integrations; not needed for Google ' + 'Ads API.', + 'least_privilege_recommendation': 'Request only when the integration also touches ' + 'Ad Manager.'}], + 'recommended_combinations': {'google_ads_api': ['https://www.googleapis.com/auth/adwords']}, + 'production_notes': { 'testing_mode_refresh_token_ttl_days': 7, + 'refresh_token_unused_invalidates_after_months': 6, + 'max_refresh_tokens_per_account_per_client': 100, + 'developer_token': 'In addition to OAuth scopes, every request requires a ' + 'Google Ads developer token issued by the Google Ads API ' + 'center. The token and OAuth consent are managed in the ' + 'API center.', + 'verification_requirement': 'The adwords scope is RESTRICTED and requires ' + 'restricted-scope OAuth App Verification and a ' + 'security assessment.', + 'default_scope_request': 'https://www.googleapis.com/auth/adwords'}}}