Google Workspace

1. Go to Google Cloud Console.
   Sign in with your Google account used to set up Google Workspace.
2. Click on the project selector (top-left dropdown near “Google Cloud”).
3. Click “New Project” to configure the project with all the necessary details:
   • Project Name: Enter a unique name for your project (For example: AirMDR).
   • Organization & Location: Enter airmdr.com as organization and location or your organization and your location.
4. Click Create.
   Now you have Successfully created a New Organization and Project in GCP
   
   Only the creator of the project has the right to manage the project.

1. Go to Google Cloud Console → APIs & Services → Library.
2. Click Enable APIs and services in the top menu.
3. Search for Each API:
   • Search “Admin SDK API”, click it, and click “Enable”.
   • Search “Google Workspace Alert Center API”, click it, and click “Enable”.
   • Search “Google Drive API”, click it, and click “Enable”.
   • Search “Gmail API”, click it, and click “Enable”.

1. Go to the Google Cloud Console.
2. Select your project.
3. Navigate to “APIs & Services” → “OAuth consent screen” in the left-navigation pane.
4. Click Get started.
5. Configure App Information with the required details:
   • App Name: airmdr-agent
   • User Support Email: Provide an email for users to contact (For Example: your email address), and Click Next.
6. Choose Audience as Internal.
7. Provide the Developer Contact Information: (For Example: your email address), and click Next.
8. In Finish, mark the checkbox to acknowledge and accept the terms of Google User Data Policy.
9. Click “Create”.
   After successful configuration, we will now have a registered application using OAuth 2.0 for authorization and the consent screen information set
   The default token request limit for this app daily is 10,000 and can be increased on request.

1. Go to Google Cloud Console → APIs & Services → Credentials → + Create credentials → Service account.
2. On the “Create Service Account” page provide the required details:
   • Service account name: airmdr-agent
   • Service account ID: airmdr-agent
   • Service account Description: Describe what this service account will do
3. Click “Create and Continue”.
4. Assign necessary roles to grant permissions:
   • “Service Account Token Creator”
   • “Viewer” or “Editor” (if needed for managing resources)
5. Click “Done”.
6. Click on the newly created service account.
7. Go to the “Keys” tab.
8. Click “Add Key” → “Create New Key”.

{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "your-private-key-id",
  "private_key": "-----BEGIN PRIVATE KEY-----YOUR-PRIVATE-KEY\n-----END PRIVATE KEY-----\n",
  "client_email": "your-client-email",
  "client_id": "your-client-id",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "your-client-x509-cert-url",
  "universe_domain": "googleapis.com"
}

1. Go to Google Workspace Admin Console.
2. Navigate to Security → Access and data control → API controls.
3. Under Domain Wide Delegation, select Manage Domain Wide Delegation → Add a new client ID and enter the required credentials:
   • OAuth 2.0 Client ID
     To retrieve Client ID:
     Navigate to Service Account in GCP and copy OAuthID
     or
     Copy from the JSON file generated while configuring the Service Account.
   • OAuth Scopes
     To retrieve OAuth Scopes:
     Navigate to Google Cloud Console → IAM & Admin → Service accounts OAuth2 Client ID (Visible in the header section of the service account)
     
     OAuth Scopes:
     https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/apps.alerts
     https://www.googleapis.com/auth/admin.directory.user.readonly
     https://www.googleapis.com/auth/admin.directory.group.readonly
     https://www.googleapis.com/auth/admin.directory.user
     https://www.googleapis.com/auth/drive.readonly
     https://www.googleapis.com/auth/gmail.readonly
   
4. Click “AUTHORIZE”.
5. Open the newly added client and select View details.
6. Confirm that all required scopes are displayed.

• Be an active Google Workspace user in the customer’s Workspace domain.
• Have Admin API → Users → Read permission.
• Have Admin API → Groups → Read permission.
• Have access to the Gmail and Google Drive resources that AirMDR must retrieve.
• Have the required Admin API privileges for the AirMDR skills being used.
• Have access to the required Alert Center, Reports, Gmail, and Drive resources.
• Remain active while the AirMDR connection is in use.

A dedicated Workspace account such as svc-airmdr-google@example.com is valid and preferred, provided it has the required Google Workspace privileges.

​

✅ Summary of Retrieved Credentials