Inputs specific to the wrap and unwrap API routes

Input

Description

 Source of the input
authentication.email

User's email address.
In UTF8 format, in lower case.

 JWT authentication token provided by the IDP.
authentication.googleEmail

Optional If the email field is not a Google Workspace address belonging to the domain, googleEmail is the user's email address. It takes priority over the email field.
In UTF8 format, in lower case.

 JWT authentication token provided by the IDP.
authentication.iss

Entity which has created and signed the token.

 JWT authentication token provided by the IDP.
authentication.aud

Corresponds to the audience for which the token was issued.

Example: [ 'cse-authorization', 'cse-authorization1' ]

 JWT authentication token provided by the IDP.
authentication.iat

Date when the token was issued. In timestamp format (integer)

Example: 1677679386

 JWT authentication token provided by the IDP.
authentication.exp

Date when the token expires.

In timestamp format (integer)

Example: 1677679386

 JWT authentication token provided by the IDP.
authentication.customClaims

Optional.

Custom claims provided par the IDP.

See Inputs specific to the wrap and unwrap API routes.

 JWT authentication token provided by the IDP.
authorization.iss

Entity which has created and signed the token.

Can be used to differentiate the various Google Workspace applications, or to migrate from a KACLS to another.

Example: “gsuitecse-tokenissuer-drive@system.gserviceaccount.com”

See Authorization settings.

 JWT authorization token provided by Google
authorization.role

Role of the authorized user.

  • "writer" for wrap and unwrap,

  • "reader" for unwrap

 JWT authorization token provided by Google
authorization.aud

Corresponds to the audience for which the token was issued.

Example: [ 'cse-authorization', 'cse-authorization1' ]

 JWT authorization token provided by Google
authorization.exp

Date when the token expires.

In timestamp format (integer)

Example: 1677679386

 JWT authorization token provided by Google
authorization.iat

IssuedAt, date when the token was issued.

In timestamp format (integer)

Example: 1677679386

 JWT authorization token provided by Google
authorization.emailType

Identifies the origin of the e-mail address in the token.

Prescribed values:

  • "google" for Google accounts (default value),

  • "google-visitor" for Google-verified accounts,

  • "customer-idp" for IDP accounts.

 JWT authorization token provided by Google
authorization.kaclsOwnerDomain Optional claim configured by the Google Workspace's owner to change the domain used in the request to the KACLS. It prevents from registering unauthorized KACLS. This claim is sent to the OPA server, which allows or forbids the action based on this information. JWT authorization token provided by Google
contentType

Cryptographic content type.

Prescribed value: "dek"

 Cryptographic component used.