Google Workspace
One OAuth flow gives Trefur four complementary signals into Google's AI surface, plus a third-party OAuth-grant inventory for unmanaged AI discovery.
What you get
- Gemini in Workspace apps — Gemini activity inside Gmail, Docs, Sheets, Slides, and Meet, pulled from the Admin SDK Reports API.
- gemini.google.com (consumer) — activity from the Workspace-managed consumer Gemini surface, de-duplicated against the Workspace-app events so nothing is double-counted.
- Third-party OAuth-grant inventory — a rollup of the AI tools and integrations your users have granted access to, for unmanaged-AI discovery.
Vertex AI / Gemini API and Cloud Assist audit-log ingestion is configured through the separate Google Cloud connector, which requests Cloud Audit Logs access.
Setup
- Sign in to app.trefur.com with a Workspace super-admin account (required for org-wide Admin SDK scopes).
- Open Sources → Connections → Google Workspace → Connect.
- Trefur shows the OAuth scopes that will be requested with a plain-English description of each.
- Confirm. You're bounced to Google's OAuth consent screen.
- On callback, Trefur runs an instant initial scan. Background polling continues on your plan's schedule.
OAuth scopes requested
| Scope | What it grants |
|---|---|
https://www.googleapis.com/auth/chat.spaces.readonly | Read Google Chat spaces. |
https://www.googleapis.com/auth/chat.memberships.readonly | Read Google Chat space memberships. |
https://www.googleapis.com/auth/admin.reports.audit.readonly | Read Admin SDK audit reports. |
https://www.googleapis.com/auth/admin.directory.user.readonly | Read directory users. |
https://www.googleapis.com/auth/admin.directory.user.security | List the third-party apps each user has granted access to and the permissions granted. Trefur also uses it to delete one app's access tokens for the people an owner or admin of your Trefur workspace chooses, only when they click Remove access and confirm with a second factor (Admin SDK tokens.delete). It is never automatic. |
https://www.googleapis.com/auth/script.processes | Read Apps Script process activity. |
Note on Vertex AI prompt + response capture: the Cloud Audit Logs path does not include prompt or response bodies — Google's API does not surface them. To get prompt-level fidelity, send your application's OpenTelemetry traces to Trefur (see the quickstart).
Disconnect
In the Trefur dashboard, open the integration and click Disconnect. Trefur revokes the refresh token immediately and purges scheduled scans. The historical telemetry it has already collected stays in your tenant.
Linked surfaces
- Unmanaged AI discovery — the OAuth-grant inventory feeds the unmanaged AI rollup.