Google: Gmail users settings cse keypairs schemas
9 Google schemas with complete fields and constraints.
← Gmail users settings cse keypairs operations · All schemas
Creates and uploads a client-side encryption S MIME public key certificate chain and private key metadata for the authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A client-side encryption S/MIME key pair, which is comprised of a public key, its certificate chain, and metadata for its paired private key. Gmail uses the key pair to complete the following tasks: - Sign outgoing client-side encrypted messages. - Save and reopen drafts of client-side encrypted messages. - Save and reopen sent messages. - Decrypt incoming or archived S/MIME messages. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured. |
disableTime | string | Optional | Output only. If a key pair is set to `DISABLED`, the time that the key pair's state changed from `ENABLED` to `DISABLED`. This field is present only when the key pair is in state `DISABLED`. Format: google-datetime Read only: true |
enablementState | string | Optional | Output only. The current state of the key pair. One of: stateUnspecified, enabled, disabled Read only: true |
keyPairId | string | Optional | Output only. The immutable ID for the client-side encryption S/MIME key pair. Read only: true |
pem | string | Optional | Output only. The public key and its certificate chain, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. Read only: true |
pkcs7 | string | Optional | Input only. The public key and its certificate chain. The chain must be in [PKCS#7](https://en.wikipedia.org/wiki/PKCS_7) format and use PEM encoding and ASCII armor. |
privateKeyMetadata | array | Optional | Metadata for instances of this key pair's private key. |
privateKeyMetadata[] | Model | Each item | Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item |
subjectEmailAddresses | array | Optional | Output only. The email address identities that are specified on the leaf certificate. Read only: true |
subjectEmailAddresses[] | string | Each item |
Deletes a client-side encryption key pair permanently and immediately You can only permanently delete key pairs that have been turned off for more than 30 days To turn off a key pair, use the Disable Cse Key Pair method Gmail can't restore or decrypt any messages that were encrypted by an obliterated key Authenticated users and Google Workspace administrators lose access to reading the encrypted messages For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Request to obliterate a CSE key pair. |
Lists client-side encryption key pairs for an authenticated user For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body
Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A client-side encryption S/MIME key pair, which is comprised of a public key, its certificate chain, and metadata for its paired private key. Gmail uses the key pair to complete the following tasks: - Sign outgoing client-side encrypted messages. - Save and reopen drafts of client-side encrypted messages. - Save and reopen sent messages. - Decrypt incoming or archived S/MIME messages. For administrators managing identities and keypairs for users in their organization, requests require authorization with a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) that has [domain-wide delegation authority](https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority) to impersonate users with the `https://www.googleapis.com/auth/gmail.settings.basic` scope. For users managing their own identities and keypairs, requests require [hardware key encryption](https://support.google.com/a/answer/14153163) turned on and configured. |
disableTime | string | Optional | Output only. If a key pair is set to `DISABLED`, the time that the key pair's state changed from `ENABLED` to `DISABLED`. This field is present only when the key pair is in state `DISABLED`. Format: google-datetime Read only: true |
enablementState | string | Optional | Output only. The current state of the key pair. Known values: stateUnspecified, enabled, disabled Read only: true |
keyPairId | string | Optional | Output only. The immutable ID for the client-side encryption S/MIME key pair. Read only: true |
pem | string | Optional | Output only. The public key and its certificate chain, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. Read only: true |
pkcs7 | string | Optional | Input only. The public key and its certificate chain. The chain must be in [PKCS#7](https://en.wikipedia.org/wiki/PKCS_7) format and use PEM encoding and ASCII armor. |
privateKeyMetadata | array | Optional | Metadata for instances of this key pair's private key. |
privateKeyMetadata[] | Model | Each item | Expand Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item |
subjectEmailAddresses | array | Optional | Output only. The email address identities that are specified on the leaf certificate. Read only: true |
subjectEmailAddresses[] | string | Each item |
Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item
Referenced models: Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item hardware Key Metadata, Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item kacls Key Metadata
Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item hardware Key Metadata
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Metadata for hardware keys. If [hardware key encryption](https://support.google.com/a/answer/14153163) is set up for the Google Workspace organization, users can optionally store their private key on their smart card and use it to sign and decrypt email messages in Gmail by inserting their smart card into a reader attached to their Windows device. |
description | string | Optional | Description about the hardware key. |
Retrieves an existing client-side encryption key pair For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — response body — private Key Metadata item kacls Key Metadata
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Metadata for a cryptographic key managed by an external key access control list service. For details about managing key access, see [Google Workspace CSE API Reference](https://developers.google.com/workspace/cse/reference). |
kaclsData | string | Optional | Opaque data generated and used by the key access control list service. |
kaclsUri | string | Optional | The URI of the key access control list service that manages the key. |
Turns off a client-side encryption key pair The authenticated user can no longer use the key pair to decrypt incoming CSE message texts or sign outgoing CSE mail To regain access, use the Enable Cse Key Pair to turn on the key pair After 30 days, you can permanently delete the key pair by using the Obliterate Cse Key Pair method For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Requests to turn off a client-side encryption key pair. |
Turns on a client-side encryption key pair that was turned off The key pair becomes active again for any associated client-side encryption identities For administrators managing identities and keypairs for users in their organization, requests require authorization with a service account (https: developers google com identity protocols O Auth2 Service Account) that has domain-wide delegation authority (https: developers google com identity protocols O Auth2 Service Account#delegatingauthority) to impersonate users with the `https: www googleapis com auth gmail settings basic` scope For users managing their own identities and keypairs, requests require hardware key encryption (https: support google com a answer 14153163) turned on and configured — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Requests to turn on a client-side encryption key pair. |