Inputs specific to the digest and systemwrap API routes
|
Input |
Description |
Source of the input |
|---|---|---|
| authorization.email | User’s email address. In UTF8 format, in lower case. | JWT authorization token provided by Google |
| authorization.role |
Role of the authorized user: "check" |
JWT authorization token provided by Google |
| authorization.resourceName | Same as resourceName, but originates from the authorization token. | JWT authorization token provided by Google |
| authorization.kaclsUrl | URL of the KACLS. | JWT authorization token provided by Google |
| authorization.iss |
Entity which has created and signed the token. Can be used to differentiate the various Google Workspace applications, or to migrate from a KACLS to another. Example: “gsuitecse-tokenissuer-drive@system.gserviceaccount.com” |
JWT authorization token provided by Google |
| authorization.aud |
Corresponds to the audience for which the token was issued. Example: [ 'cse-authorization', 'cse-authorization1' ] |
JWT authorization token provided by Google |
| authorization.exp |
Date when the token expires. In timestamp format (integer) Example: 1677679386 |
JWT authorization token provided by Google |
| authorization.iat |
IssuedAt, date when the token was issued. In timestamp format (integer) Example: 1677679386 |
JWT authorization token provided by Google |
| authorization.kaclsOwnerDomain | Optional claim configured by the Google Workspace's owner to change the domain used in the request to the KACLS. It prevents from registering unauthorized KACLS. This claim is sent to the OPA server, which allows or forbids the action based on this information. | JWT authorization token provided by Google |