> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace Alert Center

> Reference for the Tracecat Google Workspace Alert Center integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Batch delete alerts

Action ID: `tools.google_alert_center.batch_delete_alerts`

Performs batch delete operation on alerts.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/batchDelete](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/batchDelete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  The list of alert IDs to delete. Sent as the request body's `alertId` field.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alerts are associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

## Batch undelete alerts

Action ID: `tools.google_alert_center.batch_undelete_alerts`

Performs batch undelete operation on alerts.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/batchUndelete](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/batchUndelete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  The list of alert IDs to undelete. Sent as the request body's `alertId` field.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alerts are associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

## Create alert feedback

Action ID: `tools.google_alert_center.create_alert_feedback`

Creates new feedback for an alert. Attempting to create a feedback for a non-existent alert returns `NOT_FOUND` error. Attempting to create a feedback for an alert that is marked for deletion returns `FAILED_PRECONDITION` error.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts.feedback/create](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts.feedback/create)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The identifier of the alert this feedback belongs to.
</ParamField>

<ParamField path="type" type="string" required>
  The type of the feedback. One of `NOT_USEFUL` (the alert report is not useful), `SOMEWHAT_USEFUL` (the alert report is somewhat useful) or `VERY_USEFUL` (the alert report is very useful).
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alert is associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

## Delete alert

Action ID: `tools.google_alert_center.delete_alert`

Marks the specified alert for deletion. An alert that has been marked for deletion is removed from Alert Center after 30 days. Marking an alert for deletion has no effect on an alert which has already been marked for deletion. Attempting to mark a nonexistent alert for deletion results in a `NOT_FOUND` error.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/delete](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The identifier of the alert to delete.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alert is associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

## Get alert

Action ID: `tools.google_alert_center.get_alert`

Gets the specified alert. Attempting to get a nonexistent alert returns `NOT_FOUND` error.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/get](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The identifier of the alert to retrieve.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alert is associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

## Get alert metadata

Action ID: `tools.google_alert_center.get_alert_metadata`

Returns the metadata of an alert. Attempting to get metadata for a non-existent alert returns `NOT_FOUND` error.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/getMetadata](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/getMetadata)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The identifier of the alert this metadata belongs to.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alert metadata is associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

## List alert feedback

Action ID: `tools.google_alert_center.list_alert_feedback`

Lists all the feedback for an alert. Attempting to list feedbacks for a non-existent alert returns `NOT_FOUND` error.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts.feedback/list](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts.feedback/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The alert identifier. The "-" wildcard could be used to represent all alerts.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alert is associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A query string for filtering alert feedback results. Supported filter fields are `alertId` and `feedbackId`, for example `alertId = alertId01 AND feedbackId = feedbackId01`.

  Default: `null`.
</ParamField>

## List alerts

Action ID: `tools.google_alert_center.list_alerts`

Lists the alerts.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/list](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alerts are associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  A query string for filtering alert results. Supported filter fields are `alertId`, `type`, `source`, `createTime`, `startTime` and `endTime`; the time fields take an RFC 3339 date-time string, for example `createTime >= "2018-04-05T00:00:00Z"`.

  Default: `null`.
</ParamField>

<ParamField path="order_by" type="string | null">
  The sort order of the list results. If not specified results may be returned in arbitrary order. Currently supported sorting are `createTime asc`, `createTime desc`, `updateTime desc`.

  Default: `null`.
</ParamField>

<ParamField path="page_size" type="integer | null">
  The requested page size. Server may return fewer items than requested. If unspecified, server picks an appropriate default.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  A token identifying a page of results the server should return. If empty, a new iteration is started. To continue an iteration, pass in the value from the previous ListAlertsResponse's `nextPageToken` field.

  Default: `null`.
</ParamField>

## Undelete alert

Action ID: `tools.google_alert_center.undelete_alert`

Restores, or "undeletes", an alert that was marked for deletion within the past 30 days. Attempting to undelete an alert which was marked for deletion over 30 days ago (which has been removed from the Alert Center database) or a nonexistent alert returns a `NOT_FOUND` error. Attempting to undelete an alert which has not been marked for deletion has no effect.

Reference: [https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/undelete](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/undelete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The identifier of the alert to undelete.
</ParamField>

<ParamField path="customer_id" type="string | null">
  The unique identifier of the Google Workspace account of the customer the alert is associated with. The `customerId` must have the initial "C" stripped (for example, `046psxkn`). Inferred from the caller identity if not provided. This method takes the customer in the request body, not as a query parameter.

  Default: `null`.
</ParamField>