Settings available in the API

This document describes the settings that the Policy API supports.

If the supported settings are missing from the Cloud Identity Policy API response, see Default field values. If the missing setting is not mentioned in Default field values, contact Cloud Customer Care.

API Controls

API Controls Sub-Settings

This table provides API Controls sub-settings that are referenced by other API Controls settings.

Calendar Settings

Chat Settings

Classroom Settings

Data Compliance Settings

Directory Settings

Drive and Docs Settings

Gmail Settings

Gmail Sub-Settings

This table provides Gmail sub-settings that are referenced by other Gmail settings.

Groups For Business Settings

Legal and Compliance

Marketplace Settings

Marketplace Sub-Settings

The workspace_marketplace.apps_allowlist setting in the API response exposes the Marketplace application_id, instead of application_name. The following Python script can be used to convert one or more application_id that are specified on the command line to application_name.

import re
import requests
import sys

output = {}
app_ids = sys.argv[1:]

for id in app_ids:
  url = f"https://workspace.google.com/marketplace/app/_/{id}"
  response = requests.get(url, allow_redirects=False)
  final_url = response.headers['Location']
  pattern = f"^https://workspace.google.com/marketplace/app/(.*)/{id}$"
  a = re.search(pattern, final_url)
  output[id] = a.group(1)

# Output application name captured from returned URL
print(output)

Meet Settings

Provisioning Settings

Rules and Detectors Settings

Data Protection Rules Settings

For an overview of how to create data protection rules and detectors for the supported applications, see Create data protection rules.

Triggers

The following table provides the list of available platforms, applications, and triggers:

Conditions

To represent data conditions, the API uses Common Expressions Language (CEL) expressions. Each condition follows the pattern of {content type}.{content to scan for}({additional scan parameters}). For example, all_content.contains('apple') represents a data condition that matches if any of the scanned content (e.g. Drive doc, chat message, etc) contains the substring apple.

Content type

The list of available content types, corresponding to the matching configurations of the same names in the Admin Console.

• access_levels
• all_content
• all_headers
• body
• destination_type
• destination_url
• drive_enterprise_metadata
• encryption_state
• envelope_from
• file_size_in_bytes
• file_type
• from_header
• message_security_status
• request_attributes
• sender_header
• source_chrome_context
• source_url
• source_url_category
• subject
• suggestion
• target_user
• title
• to_header_recipients
• url
• url_category

Content to scan for

The list of available content to scan for, corresponding to the matching configurations of the same names in the Admin Console.

• contains({string})
• starts_with({string})
• ends_with({string})
• equals({string})
• matches_dlp_detector({detector name}, {likelihood}, {minimum_match_count: {count}, minimum_unique_match_count: {count}})
  • Corresponds to the matches predefined data type option in the Admin Console.
  • {detector name} denotes the predefined data type to scan for, which can be one of the built-in infotypes supported by Cloud DLP: https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference. For example, CREDIT_CARD_NUMBER or US_SOCIAL_SECURITY_NUMBER
  • {likelihood} denotes the likelihood threshold of the match. For example, google.privacy.dlp.v2.Likelihood.LIKELY corresponds to the High threshold in the Admin Console.
• matches_regex_detector({detector name}, {minimum_match_count: {count}})
  • Corresponds to the matches regular expression option in the Admin Console.
  • {detector name} is the resource name of the policy that represents the regular expression detector. See Data Protection Detector section on how to query detector policies in the API.
• matches_word_list({detector name}, {minimum_match_count: {count}, minimum_unique_match_count: {count}})
  • Corresponds to the matches words from word list option in the Admin Console.
  • {detector name} is the resource name of the policy that represents the word list detector. See Data Protection Detector section on how to query detector policies in the API.
• matches_web_category({category})
  • Corresponds to the URL category matches option in the Admin Console for Chrome URL visited trigger.
  • {category} denotes the URL category supported by the Admin Console configuration. For the list of available categories and their API representations, see URL categories.

Composite conditions

Multiple base conditions can be mixed with AND (&&), OR (||), or NOT (!) operators to form a composite condition. For example, "all_content.contains('apple') && all_content.contains('banana')" represents a condition that matches if any of the scanned content contains both 'apple' and 'banana' substrings.

Actions

Each application specifies the action to take when the data condition matches in a nested message. For example, { "driveAction" { "warnUser" { } } } represents a Drive action that warns users on external sharing. The application specific actions available are the following:

Rule type specific metadata

This attribute contains the metadata specific to the rule type. For Data Protection rules, it contains the alerting event severity when the event is reported under the security dashboard and alert center. An example value of the metadata representing LOW alert severity:

fields {
  key: "ruleTypeMetadata"
  value {
    struct_value {
      fields {
        key: "dlpRuleMetadata"
        value {
          struct_value {
            fields {
              key: "alertSeverity"
              value {
                string_value: "LOW"
              }
            }
          }
        }
      }
    }
  }
}

Data Protection Detectors Settings

For an overview of data protection rules and detectors, see Create DLP for Drive rules and custom content detectors.

System Defined Alert Rules Settings

This section describes Google Workspace system-defined alert rules. The API returns only system-defined alerts that are modified from the default value by the administrator.

Actions

System defined alert rules have a single action that denotes the notification settings for the alert.

Security Settings

Service Status Settings

The service_status setting contains a boolean value implying if a service is enabled for a certain OrgUnit or Group.

The Policy API supports service status settings for Google Workspace, Additional Google services, and Generative AI services that are listed in the Admin Console.

Google Workspace

Additional Google services

Generative AI

Sites Settings

UserTakeout Settings