Google: Turns off a client-side encryption key pair The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail To regain access, use the Enable Cse Key Pair to turn on the key pair After 30 days, you can permanently delete the key pair by using the Obliterate Cse Key Pair method For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured

← gmail_users_settings_cse_keypairs operations · Get started · OpenAPI downloads

Contract 2026-10-27 · Operation google.gmail_users_settings_cse_keypairs_disable

Provider route: POST /gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:disable. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/google with npm, or alter-sdk-google with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GoogleIntegration } from "@alter-ai/google";

async function execute(input: Parameters<GoogleIntegration["gmailUsersSettingsCseKeypairs"]["gmailUsersSettingsCseKeypairsDisable"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GoogleIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.gmailUsersSettingsCseKeypairs.gmailUsersSettingsCseKeypairsDisable(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_google import GoogleIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GoogleIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.gmail_users_settings_cse_keypairs.gmail_users_settings_cse_keypairs_disable(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.keyPairId	string	Required within parent	The identifier of the key pair to turn off.
path.userId	string	Required within parent	The requester’s primary email address. To indicate the authenticated user, you can use the special value `me`. Default: me
query	object	Optional	Additional keys: not allowed
query.fields	string	Optional	Selector specifying which fields to include in a partial response.
query.prettyPrint	boolean	Optional	Returns response with indentations and line breaks. Default: true
query.quotaUser	string	Optional	Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.
body	Model	Required within parent	Expand Turns off a client-side encryption key pair The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail To regain access, use the Enable Cse Key Pair to turn on the key pair After 30 days, you can permanently delete the key pair by using the Obliterate Cse Key Pair method For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body

Referenced models: Turns off a client-side encryption key pair The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail To regain access, use the Enable Cse Key Pair to turn on the key pair After 30 days, you can permanently delete the key pair by using the Obliterate Cse Key Pair method For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Referenced models: Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Policy, approvals and errors

SDK function policy ID: google.gmail_users_settings_cse_keypairs_disable. Catalog operation: gmail.users.settings.cse.keypairs.disable. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Required provider scopes: ["https://www.googleapis.com/auth/gmail.settings.basic", "https://www.googleapis.com/auth/gmail.settings.sharing"]

Official provider source