Settings available in the API

This document describes the settings that the Policy API supports.

If the supported settings are missing from the Cloud Identity Policy API response, see Default field values . If the missing setting is not mentioned in Default field values , contact Cloud Customer Care .

API Controls

API Controls Sub-Settings

This table provides API Controls sub-settings that are referenced by other API Controls settings.

Calendar Settings

Chat Settings

Classroom Settings

Data Compliance Settings

Directory Settings

Drive and Docs Settings

Gmail Settings

Gmail Sub-Settings

This table provides Gmail sub-settings that are referenced by other Gmail settings.

Groups For Business Settings

Legal and Compliance

Marketplace Settings

Marketplace Sub-Settings

The workspace_marketplace.apps_allowlist setting in the API response exposes the Marketplace application_id , instead of application_name . The following Python script can be used to convert one or more application_id that are specified on the command line to application_name .

  import 
  
 re 
 import 
  
 requests 
 import 
  
 sys 
 output 
 = 
 {} 
 app_ids 
 = 
 sys 
 . 
 argv 
 [ 
 1 
 :] 
 for 
 id 
 in 
 app_ids 
 : 
 url 
 = 
 f 
 "https://workspace.google.com/marketplace/app/_/ 
 { 
 id 
 } 
 " 
 response 
 = 
 requests 
 . 
 get 
 ( 
 url 
 , 
 allow_redirects 
 = 
 False 
 ) 
 final_url 
 = 
 response 
 . 
 headers 
 [ 
 'Location' 
 ] 
 pattern 
 = 
 f 
 "^https://workspace.google.com/marketplace/app/(.*)/ 
 { 
 id 
 } 
 $" 
 a 
 = 
 re 
 . 
 search 
 ( 
 pattern 
 , 
 final_url 
 ) 
 output 
 [ 
 id 
 ] 
 = 
 a 
 . 
 group 
 ( 
 1 
 ) 
 # Output application name captured from returned URL 
 print 
 ( 
 output 
 ) 
 

Meet Settings

Provisioning Settings

Rules and Detectors Settings

Data Protection Rules Settings

For an overview of how to create data protection rules and detectors for the supported applications, see Create data protection rules .

Triggers

The following table provides the list of available platforms, applications, and triggers:

Conditions

To represent data conditions, the API uses Common Expressions Language (CEL) expressions. Each condition follows the pattern of {content type}.{content to scan for}({additional scan parameters}) . For example, all_content.contains('apple') represents a data condition that matches if any of the scanned content (e.g. Drive doc, chat message, etc) contains the substring apple .

Content type

The list of available content types, corresponding to the matching configurations of the same names in the Admin Console.

• access_levels
• all_content
• all_headers
• body
• destination_type
• destination_url
• drive_enterprise_metadata
• encryption_state
• envelope_from
• file_size_in_bytes
• file_type
• from_header
• message_security_status
• request_attributes
• sender_header
• source_chrome_context
• source_url
• source_url_category
• subject
• suggestion
• target_user
• title
• to_header_recipients
• url
• url_category

Content to scan for

The list of available content to scan for, corresponding to the matching configurations of the same names in the Admin Console.

• contains({string})
• starts_with({string})
• ends_with({string})
• equals({string})
• matches_dlp_detector({detector name}, {likelihood}, {minimum_match_count: {count}, minimum_unique_match_count: {count}})
  • Corresponds to the matches predefined data typeoption in the Admin Console.
  • {detector name} denotes the predefined data type to scan for, which can be one of the built-in infotypes supported by Cloud DLP: https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference. For example, CREDIT_CARD_NUMBER or US_SOCIAL_SECURITY_NUMBER
  • {likelihood} denotes the likelihood threshold of the match. For example, google.privacy.dlp.v2.Likelihood.LIKELYcorresponds to the Highthreshold in the Admin Console.
• matches_regex_detector({detector name}, {minimum_match_count: {count}})
  • Corresponds to the matches regular expressionoption in the Admin Console.
  • {detector name} is the resource name of the policy that represents the regular expression detector. See Data Protection Detector section on how to query detector policies in the API.
• matches_word_list({detector name}, {minimum_match_count: {count}, minimum_unique_match_count: {count}})
  • Corresponds to the matches words from word listoption in the Admin Console.
  • {detector name} is the resource name of the policy that represents the word list detector. See Data Protection Detector section on how to query detector policies in the API.
• matches_web_category({category})
  • Corresponds to the URL category matchesoption in the Admin Console for Chrome URL visited trigger.
  • {category} denotes the URL category supported by the Admin Console configuration. For the list of available categories and their API representations, see URL categories .
• contains_word({string})
  • Matches if the content contains {string} as a whole word.
• matches_file_extension({extension})
  • Matches if the file extension is {extension} .
• matches_mime_types({categories}, {custom_types})
  • Matches if the file's MIME type belongs to one of the specified {categories} or {custom_types} .
• matches_metadata({metadata_criteria})
  • Matches Drive files based on {metadata_criteria} defined in Drive labels.
• matches_enum({enum_value})
  • Matches enum-based fields against {enum_value} . For example, encryption_state.matches_enum('ENCRYPTED') .
• matches_url_list({url_list_id})
  • Matches if the URL is present in the specified URL list {url_list_id} .
• matches_url_risk_level({risk_level})
  • Matches if the URL risk level is {risk_level} .
• matches_address({email})
  • Matches if the email address is {email} .
• matches_address_domain_name({domain})
  • Matches if domain of the email address is {domain} .
• matches_address_regex({regex})
  • Matches if the email address matches the regular expression {regex} .

Composite conditions

Multiple base conditions can be mixed with AND (&&), OR (||), or NOT (!) operators to form a composite condition. For example, "all_content.contains('apple') && all_content.contains('banana')" represents a condition that matches if any of the scanned content contains both 'apple' and 'banana' substrings.

CEL Expression Syntax for Rules

The Common Expression Language (CEL) expression that defines a rule's logic is found within the condition field of the Rule resource. This field is typically a google.type.Expr message, with the CEL expression in either an expression or cel_expression field.

To create a valid rule, you must use CEL functions that are supported by the specific application, trigger event, and content type (match source) that you're targeting.

The following table lists the available match sources and condition functions for each application and trigger for Data Protection (DLP) rules.

Actions

Each application specifies the action to take when the data condition matches in a nested message. For example, { "driveAction" { "warnUser" { } } } represents a Drive action that warns users on external sharing. The application specific actions available are the following:

Action Parameters

Action parameters provide additional configuration for rule actions. The available parameters depend on the application.

Example of Setting Action Parameters

The following example demonstrates how to specify action parameters for a Chrome blockContent action, enabling the Evidence Locker ( saveContent ) and setting a watermark message ( watermarkMessage ). This uses the generic Struct representation used by the API.

 fields {
  key: "action"
  value {
    struct_value {
      fields {
        key: "chromeAction"
        value {
          struct_value {
            fields {
              key: "blockContent"
              value {
                struct_value {
                  fields {
                    key: "actionParams"
                    value {
                      struct_value {
                        fields {
                          key: "saveContent"
                          value {
                            bool_value: true
                          }
                        }
                        fields {
                          key: "watermarkMessage"
                          value {
                            string_value: "CONFIDENTIAL"
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
} 

Drive Action Parameters

Drive actions generally do not take additional parameters. However, the restrictCopyPrintDownload action requires specifying a scope.

Gmail Action Parameters

Chat Action Parameters

Google Chrome Action Parameters

ChromeOS Action Parameters

Rule type specific metadata

This attribute contains the metadata specific to the rule type. For Data Protection rules, it contains the alerting event severity when the event is reported under the security dashboard and alert center. An example value of the metadata representing LOW alert severity:

 fields {
  key: "ruleTypeMetadata"
  value {
    struct_value {
      fields {
        key: "dlpRuleMetadata"
        value {
          struct_value {
            fields {
              key: "alertSeverity"
              value {
                string_value: "LOW"
              }
            }
          }
        }
      }
    }
  }
} 

Data Protection Detectors Settings

For an overview of data protection rules and detectors, see Create DLP for Drive rules and custom content detectors .

System Defined Alert Rules Settings

This section describes Google Workspace system-defined alert rules. The API returns only system-defined alerts that are modified from the default value by the administrator.

Actions

System defined alert rules have a single action that denotes the notification settings for the alert.

Action Parameters

The following table provides the parameters for the alertCenterAction :

Security Settings

Service Status Settings

The service_status setting contains a boolean value implying if a service is enabled for a certain OrgUnit or Group .

The Policy API supports service status settings for Google Workspace, Additional Google services, and Generative AIservices that are listed in the Admin Console.

Google Workspace

Additional Google services

Generative AI

Sites Settings

UserTakeout Settings