rocketkind
Security

Google Vault

Google Vault is the eDiscovery and retention surface for a Google Workspace organization: matters, holds that stop data being purged, searches, and exports of Gmail, Drive, Chat, Groups, Voice, Calendar and Gemini data.

Authentication

  • OAuth 2.0

Actions

Generic API request. Call any Google Vault API endpoint on this connection, for the case where no shipped action covers it yet. The connection supplies the base URL, the authentication and the egress route, so only the path, query and body are yours to fill.

  • Add held accountAdd one account to an existing account-scoped hold, so its data is preserved from now on.
  • Add held accounts (batch)Add several accounts to an account-scoped hold in one call.
  • Add matter collaboratorDestructiveGrant a Workspace account access to a matter, so it can run searches and exports there without holding organization-wide eDiscovery privileges.
  • Cancel operationDestructiveAsk Vault to stop a long-running operation.
  • Close matterDestructiveClose a matter once the case is over.
  • Count matter artifactsCount how many messages or files a search would return, without exporting anything.
  • Create exportStart a Vault export: run a search across one Workspace service and write the matching messages or files to Google-managed Cloud Storage.
  • Create holdPlace a Vault hold so the scoped data survives retention rules and user deletion for as long as the hold stands.
  • Create matterOpen a new Vault matter — the container every hold, saved query and export in this connector hangs off, so this is normally the first call in an eDiscovery workflow.
  • Create saved queryStore a search inside a matter so the same scope can be re-run or reviewed later without re-typing it.
  • Delete exportDestructiveDelete an export and the files it produced in Cloud Storage.
  • Delete holdDestructiveRemove a hold and release everything it was preserving.
  • Delete matterDestructiveSoft-delete a matter.
  • Delete operationDestructiveForget a long-running operation's bookkeeping record.
  • Delete saved queryDestructiveDelete a stored search definition from a matter.
  • Get exportRead one export by id — the poll step of an export workflow.
  • Get holdRead one hold by id, including the accounts or organizational unit it covers and the query narrowing it.
  • Get matterRead one Vault matter by id to check its current state before acting on it — a hold or export against a CLOSED matter is rejected, and a DELETED matter has to be undeleted first.
  • Get operationPoll a Vault long-running operation — in practice the one countmatterartifacts started.
  • Get saved queryRead one stored search definition by id.
  • List exportsList the exports in one matter, newest first, so a workflow can find an export it started earlier or check whether an equivalent one already ran before paying for another.
  • List held accountsList the accounts individually named on a hold, with the time each was added.
  • List holdsList the holds inside one matter, so a workflow can audit what a matter is currently preserving before closing it — closing a matter releases every hold it contains.
  • List mattersList the Vault matters the connected account can see, so a workflow can pick one to hold, search or export.
  • List operationsList the long-running operations under a parent resource, so a workflow that lost an operation name can find its count job again.
  • List saved queriesList the saved searches stored in one matter, each with its full query definition.
  • Remove held accountDestructiveTake one account off a hold, releasing its data from that hold's preservation.
  • Remove held accounts (batch)DestructiveTake several accounts off a hold in one call, releasing their data from that hold's preservation.
  • Remove matter collaboratorDestructiveRevoke one account's access to a matter.
  • Reopen matterDestructiveReopen a closed matter so it can take holds, saved queries and exports again.
  • Undelete matterDestructiveRestore a soft-deleted matter, putting it back in the CLOSED state it was in before deletematter ran.
  • Update holdDestructiveReplace a hold's scope and query in place.
  • Update matterDestructiveRename a matter or rewrite its description.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.