General

Scopes

What a key may do. You pick these when you create the key, and they can only ever narrow what you can already do yourself.

Two rules worth knowing

Reading and writing are always separate, and sending is separate from writing. A key that can draft mail cannot send it unless you also grant mail.send.

Sharing is separate from writing. A key granted files.write to organise a drive cannot expose its contents to anyone else.

Scope	Grants
`admin.audit.read` sensitive	Read your workspace audit log
`admin.billing.read` sensitive	See your workspace plan and licences
`admin.domains.read` sensitive	See your workspace domains and their DNS status
`admin.users.read` sensitive	See everyone in your workspace and their account details
`admin.users.write` sensitive	Create, suspend and delete people in your workspace
`calendar.booking.write` sensitive	Manage your booking pages and send invitations
`calendar.events.read`	Read your calendars and events
`calendar.events.write` sensitive	Create and change events on your calendars
`calendar.freebusy.read`	See when you and your colleagues are free
`contacts.read`	Read your contacts
`contacts.write`	Create and change your contacts
`directory.read`	See the people and groups in your workspace
`docs.comments.read`	Read comments on your documents
`docs.comments.write`	Post and resolve comments on your documents
`docs.documents.read`	Read your documents
`docs.documents.write`	Create and change your documents
`files.read`	Read your files and download their contents
`files.share` sensitive	Share your files with other people
`files.write`	Upload, move, rename and delete your files
`identity.read`	Read your profile
`mail.folders.read`	See your mail folders
`mail.folders.write`	Create, rename and delete your mail folders
`mail.messages.read`	Read your email
`mail.messages.write`	Organise your email: flags, folders, drafts, deletion
`mail.send` sensitive	Send email as you
`mail.settings.read`	Read your mail settings, filters and vacation replies
`mail.settings.write`	Change your mail settings, filters and vacation replies
`sheets.structure.write` sensitive	Insert and delete rows, columns and sheets in your spreadsheets
`sheets.values.read`	Read your spreadsheets: cell values, formulas and formatting
`sheets.values.write`	Write values, formulas and formatting into your spreadsheets

Workspace admin scopes

The admin scopes are selectable only by someone who holds the workspace administrator role, and only after re-authenticating. They let a key provision people, so they are deliberately harder to obtain than the rest.