Google: Associates a different key pair with an existing client-side encryption identity The updated key pair must validate against Google's S MIME certificate profiles (https: support google com a answer 7300887) For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured

Google gmailUsersSettingsCseIdentities.gmailUsersSettingsCseIdentitiesPatch: arguments, response, policy and SDK examples.

← Gmail users settings cse identities operations · Get started

Operation google.gmail_users_settings_cse_identities_patch

Provider route: PATCH /gmail/v1/users/{userId}/settings/cse/identities/{emailAddress}. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/google with npm, or alter-sdk-google with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GoogleIntegration } from "@alter-ai/google";

async function execute(input: Parameters<GoogleIntegration["gmailUsersSettingsCseIdentities"]["gmailUsersSettingsCseIdentitiesPatch"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GoogleIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.gmailUsersSettingsCseIdentities.gmailUsersSettingsCseIdentitiesPatch(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_google import GoogleIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GoogleIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.gmail_users_settings_cse_identities.gmail_users_settings_cse_identities_patch(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`path`	object	Required within parent	Additional keys: not allowed
`path.emailAddress`	string	Required within parent	The email address of the client-side encryption identity to update.
`path.userId`	string	Required within parent	The requester’s primary email address. To indicate the authenticated user, you can use the special value `me`. Default: me
`query`	object	Optional	Additional keys: not allowed
`query.fields`	string	Optional	Selector specifying which fields to include in a partial response.
`query.prettyPrint`	boolean	Optional	Returns response with indentations and line breaks. Default: true
`query.quotaUser`	string	Optional	Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.
`body`	Model	Required within parent	Expand Retrieves a client-side encryption identity configuration For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Referenced models: Retrieves a client-side encryption identity configuration For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	Model	Root	Expand Retrieves a client-side encryption identity configuration For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Schemas

Retrieves a client-side encryption identity configuration For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body

Field	Type	Presence	Description and constraints
`$`	object	Root	The client-side encryption (CSE) configuration for the email address of an authenticated user. Gmail uses CSE configurations to save drafts of client-side encrypted email messages, and to sign and send encrypted email messages. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured.
`emailAddress`	string	Optional	The email address for the sending identity. The email address must be the primary email address of the authenticated user.
`primaryKeyPairId`	string	Optional	If a key pair is associated, the ID of the key pair, CseKeyPair.
`signAndEncryptKeyPairs`	Model	Optional	Expand Retrieves a client-side encryption identity configuration For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — sign And Encrypt Key Pairs The configuration of a CSE identity that uses different key pairs for signing and encryption.

Field	Type	Presence	Description and constraints
`$`	object	Root	The configuration of a CSE identity that uses different key pairs for signing and encryption.
`encryptionKeyPairId`	string	Optional	The ID of the CseKeyPair that encrypts signed outgoing mail.
`signingKeyPairId`	string	Optional	The ID of the CseKeyPair that signs outgoing mail.

Policy, approvals and errors

SDK function policy ID: google.gmail_users_settings_cse_identities_patch. Catalog operation: gmail.users.settings.cse.identities.patch. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Required provider scopes: ["https://www.googleapis.com/auth/gmail.settings.basic", "https://www.googleapis.com/auth/gmail.settings.sharing"]

Official provider source

Report an issue with this page