Settings available in the API

This document describes the settings that the Policy API supports.

If the supported settings are missing from the Cloud Identity Policy API response, see Default field values. If the missing setting is not mentioned in Default field values, contact Cloud Customer Care.

Security Settings

UserTakeout Settings

Marketplace Settings

The Setting workspace_marketplace.apps_allowlist in the API response exposes the Marketplace application_id instead of application_name. The following Python script can be used to convert one or more application_id that are specified on the command line to application_name.

import re
import requests
import sys

output = {}
app_ids = sys.argv[1:]

for id in app_ids:
  url = f"https://workspace.google.com/marketplace/app/_/{id}"
  response = requests.get(url, allow_redirects=False)
  final_url = response.headers['Location']
  pattern = f"^https://workspace.google.com/marketplace/app/(.*)/{id}$"
  a = re.search(pattern, final_url)
  output[id] = a.group(1)

# Output application name captured from returned URL
print(output)

Service Status Settings

The service_status setting contains a Boolean value implying a service is enabled for a certain OrgUnit or Group.

The Policy API supports service status settings for both Workspace services and Additional services listed in the Admin Console under Apps.

Gmail Settings

Gmail Sub-Settings

This table provides Gmail sub-settings that are referenced by other Gmail settings.

Chat Settings

Drive and Docs Settings

Meet Settings

Sites Settings

Groups For Business Settings

Legal and Compliance

Classroom Settings

Calendar Settings

Data Protection Rules Settings

For an overview of data protection rules and detectors, see Create DLP for Drive rules and custom content detectors.

Triggers

The list of available applications and their triggers.

• "google.workspace.chrome.file.v1.upload"
• "google.workspace.chrome.file.v1.download"
• "google.workspace.chrome.web_content.v1.upload"
• "google.workspace.chrome.page.v1.print"
• "google.workspace.chrome.url.v1.navigation"
• "google.workspace.chromeos.file.v1.transfer"
• "google.workspace.chat.message.v1.send"
• "google.workspace.chat.attachment.v1.upload"
• "google.workspace.drive.file.v1.share"
• "google.workspace.gmail.email.v1.send"

Conditions

To represent data conditions, the API uses Common Expressions Language (CEL) expressions. Each condition follows the pattern of {content type}.{content to scan for}({additional scan parameters}). For example, all_content.contains('apple') represents a data condition that matches if any of the scanned content (e.g. Drive doc, chat message, etc) contains the substring apple.

Content type

The list of available content types, corresponding to the matching configurations of the same names in the Admin Console.

• access_levels
• all_content
• all_headers
• body
• destination_type
• destination_url
• drive_enterprise_metadata
• encryption_state
• envelope_from
• file_size_in_bytes
• file_type
• from_header
• message_security_status
• request_attributes
• sender_header
• source_chrome_context
• source_url
• source_url_category
• subject
• suggestion
• target_user
• title
• to_header_recipients
• url
• url_category

Content to scan for

The list of available content to scan for, corresponding to the matching configurations of the same names in the Admin Console.

• contains({string})
• starts_with({string})
• ends_with({string})
• equals({string})
• matches_dlp_detector({detector name}, {likelihood}, {minimum_match_count: {count}, minimum_unique_match_count: {count}})
  • Corresponds to the matches predefined data type option in the Admin Console.
  • {detector name} denotes the predefined data type to scan for, which can be one of the built-in infotypes supported by Cloud DLP: https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference. For example, CREDIT_CARD_NUMBER or US_SOCIAL_SECURITY_NUMBER
  • {likelihood} denotes the likelihood threshold of the match. For example, google.privacy.dlp.v2.Likelihood.LIKELY corresponds to the High threshold in the Admin Console.
• matches_regex_detector({detector name}, {minimum_match_count: {count}})
  • Corresponds to the matches regular expression option in the Admin Console.
  • {detector name} is the resource name of the policy that represents the regular expression detector. See Data Protection Detector section on how to query detector policies in the API.
• matches_word_list({detector name}, {minimum_match_count: {count}, minimum_unique_match_count: {count}})
  • Corresponds to the matches words from word list option in the Admin Console.
  • {detector name} is the resource name of the policy that represents the word list detector. See Data Protection Detector section on how to query detector policies in the API.
• matches_web_category({category})
  • Corresponds to the URL category matches option in the Admin Console for Chrome URL visited trigger.
  • {category} denotes the URL category supported by the Admin Console configuration. For example ADULT or ONLINE_COMMUNITIES__SOCIAL_NETWORKS.

Composite conditions

Multiple base conditions can be mixed with AND (&&), OR (||), or NOT (!) operators to form a composite condition. For example, "all_content.contains('apple') && all_content.contains('banana')" represents a condition that matches if any of the scanned content contains both 'apple' and 'banana' substrings.

Actions

Each application specifies the action to take when the data condition matches in a nested message. For example, { "driveAction" { "warnUser" { } } } represents a Drive action that warns users on external sharing. The application specific actions available are following:

Rule type specific metadata

This attribute contains the metadata specific to the rule type. For Data Protection rules, it contains the alerting event severity when the event is reported under the security dashboard and alert center. An example value of the metadata representing LOW alert severity:

fields {
  key: "ruleTypeMetadata"
  value {
    struct_value {
      fields {
        key: "dlpRuleMetadata"
        value {
          struct_value {
            fields {
              key: "alertSeverity"
              value {
                string_value: "LOW"
              }
            }
          }
        }
      }
    }
  }
}

Data Protection Detectors Settings

For an overview of data protection rules and detectors, see Create DLP for Drive rules and custom content detectors.

System Defined Alert Rules Settings

This section describes Google Workspace system-defined alert rules. The API returns only system-defined alerts that are modified from the default value by the administrator.

Actions

System defined alert rules have a single action that denotes the notification settings for the alert.