Workspace Admin

Setup
Reference

What You'll Need

Credential	What it is
Service Account Key	JSON key file from Google Cloud — you’ll enter individual fields from this file (see below)
Admin Email	Google Workspace super admin email for impersonation
Domain	Your Google Workspace domain (e.g., `example.com`)

The configuration form asks for individual fields from the service account JSON key file. Open the downloaded JSON file and copy each value into the corresponding form field: type, project_id, private_key_id, private_key, client_email, client_id, auth_uri, token_uri, auth_provider_x509_cert_url, client_x509_cert_url, and universe_domain.

Overview

Connect Parable to Google Workspace for directory, Gmail, Calendar, Drive, Meet, and audit data using the Admin SDK and related APIs.

Audit & Reports

Admin audit logs, usage reports, login activity

Parable reads Google Workspace data (directory, Gmail, Calendar, Drive, Meet, and related APIs). You still use Google Cloud Console to create the service account, enable APIs, and download the JSON key — that split is normal for Workspace integrations.

Prerequisites

Setup access in . These steps require , or a colleague with equivalent permissions who can create credentials for you.If that is not you, ask your administrator.

Google Cloud Console: Create or select a GCP project, enable APIs, and create a service account — typically Project Owner or Project Editor on that project.
If your company uses a Google Cloud organization with policies that block new projects or service accounts, ask your Google Cloud organization administrator to complete or approve those steps.

Setup Guide

Create Google Cloud Project

Go to Google Cloud Console
Click Select a project → New Project
Name it: Parable Integration
Click Create

Enable Required APIs

Go to APIs & Services → Library
Search for and enable each:

API	Purpose
Admin SDK API	Directory, users, groups, org units
Gmail API	Email thread and message metadata
Google Calendar API	Calendar events
Google Drive API	Drive file index, Docs, Sheets content
Google Drive Activity API	Drive activity feed
Google Meet REST API	Meet conference records, participants, transcripts, recordings
Google Docs API	Google Doc content
Google Sheets API	Google Sheet content

Create Service Account

Go to IAM & Admin → Service Accounts
Click Create Service Account
Name: parable-workspace-<your-domain> (for example, parable-workspace-example-com)
Click Create and Continue
Skip role assignment → Done

If you connect multiple Google Workspace domains, create one service account per domain. Domain-specific names make future key rotation and audit review simpler.

Generate Service Account Key

Click on the newly created service account
Go to Keys tab → Add Key → Create new key
Select JSON format
Click Create — key file downloads automatically

Store the JSON key file securely. It cannot be downloaded again!

Rotate this key on your normal credential rotation cadence. Most teams rotate service account keys every 90 days or whenever an administrator with access leaves the company. After rotation, update the Parable connector with the new JSON key fields before deleting the old key in Google Cloud.

Enable Domain-Wide Delegation and Note Client ID

On the service account details page, go to the Details tab
Expand Advanced settings
Check Enable Google Workspace Domain-wide Delegation and click Save
The Client ID (numeric, ~21 digits) will now appear in that section — copy it for the next step

The Client ID is also available as the client_id field in the downloaded JSON key file.

Configure Domain-Wide Delegation

Open Google Admin Console
Go to Security → Access and data control → API controls
Click Manage Domain Wide Delegation
Click Add new
Enter:

Field	Value
Client ID	Service account Client ID from Step 5
OAuth Scopes	See scope list below

Add Required Scopes

Add these scopes as a comma-separated list. The exact set depends on which Google data categories you enable in Parable.

Data category	OAuth scope
Directory users	`https://www.googleapis.com/auth/admin.directory.user.readonly`
Directory groups	`https://www.googleapis.com/auth/admin.directory.group.readonly`
Organizational units	`https://www.googleapis.com/auth/admin.directory.orgunit.readonly`
Gmail metadata	`https://www.googleapis.com/auth/gmail.readonly`
Calendar events	`https://www.googleapis.com/auth/calendar.readonly`
Drive files	`https://www.googleapis.com/auth/drive.readonly`
Drive activity	`https://www.googleapis.com/auth/drive.activity.readonly`
Meet records	`https://www.googleapis.com/auth/meetings.space.readonly`
Chrome audit activity	`https://www.googleapis.com/auth/admin.reports.audit.readonly`

The optional chrome_activity tap ingests all Chrome application audit events from the Admin Reports API (login, device, DLP, Safe Browsing, content transfer, and related event types). It is not enabled by default — turn it on in your connector configuration when you need Chrome browser or ChromeOS activity in Parable. The first sync can backfill up to 90 days of history (in 7-day API windows).

Parable no longer requires deprecated per-resource Google Meet scopes. Use https://www.googleapis.com/auth/meetings.space.readonly for Meet data.

Click Authorize

Enter values in the form

Enter the values from your service account JSON key, plus Admin email and Domain, into the connector form, then click Save & test connection.

Verify Your Setup

Use a Google API client library or OAuth Playground to test:

from google.oauth2 import service_account
from googleapiclient.discovery import build

SCOPES = ['https://www.googleapis.com/auth/admin.directory.user.readonly']
SERVICE_ACCOUNT_FILE = 'path/to/service-account-key.json'
ADMIN_EMAIL = 'admin@yourcompany.com'

credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES)
delegated_credentials = credentials.with_subject(ADMIN_EMAIL)

service = build('admin', 'directory_v1', credentials=delegated_credentials)
results = service.users().list(customer='my_customer', maxResults=5).execute()
print(results.get('users', []))

Success! If you received a 200 OK response with valid data, your credentials are configured correctly. You can now proceed to configure this connector in Parable.

Enter the service account JSON fields, Admin email, and Domain in the connector form, then click Save & test connection.

Rate Limits: enforces rate limits of .Parable handles rate limiting automatically with exponential backoff, but initial syncs of large datasets may take longer due to these limits.

Troubleshooting

Error	Meaning	Solution
`403 Not Authorized to access this resource/api`	Missing delegation	Configure domain-wide delegation
`400 Invalid Input`	Wrong admin email	Use a valid super admin email
`401 Invalid Credentials`	Bad key or expired	Regenerate service account key
`429 Rate Limit Exceeded`	Too many requests	Implement exponential backoff

Common Issues

”Domain-wide delegation not configured”

Ensure the Client ID (numeric) is added to Domain-wide Delegation in Admin Console, not the service account email.

”User not found” when impersonating

The admin email used for impersonation must be a valid super admin in the Google Workspace domain.

What You'll Need

​Overview

Directory

Audit & Reports

​Prerequisites

​Setup Guide

​Verify Your Setup

​Troubleshooting

​”Domain-wide delegation not configured”

​”User not found” when impersonating

​Additional Resources

Admin SDK

Domain-Wide Delegation

Overview

Prerequisites

Setup Guide

Verify Your Setup

Troubleshooting

”Domain-wide delegation not configured”

”User not found” when impersonating

Additional Resources