# Google Drive

![Google_Drive_text_logo_grey.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936191629.png)
Google Drive is a free and paid cloud-based storage and synchronization service developed by Google. It enables users to store and access files online and syncs stored documents, photos and more across all of the user's devices, including mobile devices, tablets and PCs.

In order to integrate Google Drive with Relyance AI you will need to first grant access to the Relyance Application in the Google workspace.

In some instances, you may need to grant permissions to the Relyance Google App. Please have your Google workspace admin configure the trust relationship as outlined [here](https://support.relyance.ai/hc/article_attachments/34741946011021).

#### In your Google workspace (optional):

![gdrivepre-1.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936197261.png)
Our OAuth2.0 application needs to be trusted explicitly by the administrator of the Google workspace (our Google App Verification Request is in progress). You may need to involve the Google workspace administrator.

![gdrivepre-3.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936198925.png)

![gdrivepre-5.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946012429.png)

1. Navigate to **Security > API Controls** in your Google Admin console Home page.
2. Click on **MANAGE THIRD-PARTY APP ACCESS.**
3. Click on **Configure new app** dropdown and select **OAuth App Name Or Client ID**.
4. In the resulting screen, search for the following client ID (the Relyance AI client ID for Google Drive):
```
892114676652-slst0t12i39117d4qvdg8rm3sjlnldlf.apps.googleusercontent.com
```
5. The app should be displayed below.
6. Click on **Select.**
7. Check the **Client ID** to configure, and click on **Select** at the bottom.
8. Select **Trusted: Can access all Google services**.
9. Click on **Confirm**.
10. Ensure the **Access** column for the Relyance AI app is **Trusted.**

![gdrivepre-2.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946011405.png)

![gdrivepre-4.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936199053.png)

![gdrivepre-6.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936201101.png)

#### **In the Relyance AI application:**

![gdrive-1.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946015245.png)
![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946022669.png)
1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Contract Integration** tab.
5. Find the **Google Drive** integration card and click it to open its connections.
6. On the **Authentication** step, pick the method under **Authentication Method**.
7. Select the storage type of the Google Drive you wish to integrate with (**My Drive**, **Shared Folder**, **Shared Drive**).

 For **My Drive** or **Shared Folder**:

 i. Enter the folder names you wish to scan. If you wish to integrate multiple folders, enter the folder names delimited by a semicolon(;) that documents will be downloaded from. Documents in subfolders of specified folders will also be downloaded. Example below:

 ![gdrive-8.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946015373.png)

- Folder names are case-sensitive.
    - Spaces are allowed.
    - To download from the root folder enter a forward-slash ( **/**). For **Shared Drive:**

    ![gdrive-2.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936208141.png) i. Enter the information of the shared drive as a JSON. Use the JSON editor.
 ii. Enter the name of the shared drive as the value of **shared_drive_name**, and a comma-separated list of folder names as the value of **folder_paths** within braces.

 For example, the screenshot below downloads documents from a shared drive named **testdrive**, and scans two folders **folder1** and **folder2/sub_folder**.

 ![gdrive-3.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946016269.png) iii. To download from multiple shared drives, create a separate JSON object for each shared drive.

Refer the screenshot below for an example. The second JSON object denotes that all documents starting from the root folder in ***anotherdrive*** are downloaded.

![gdrive-4.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946016781.png) iv. Click **Authenticate**. to save your JSON configuration.

- Folder names are case-sensitive.
- Spaces are allowed.
- To download from the root folder enter a forward-slash ( **/** ).
8. Click **Authenticate**.
9. Sign into the account with document access and complete the Oauth flow by selecting **Allow**.
10. At this point, you should see the following result on the Vendor Integrations page:
11. Congratulations, you are now connected to Google Drive.

![gdrive-5.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936209677.png)

![gdrive-6.png](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946017037.png)

### Which method to choose, and why connections drop

Google Drive offers four, and they differ in how the authorisation is held — which
decides whether the connection keeps working:

| Method | Authorises as | Keeps working because |
| --- | --- | --- |
| **Domain Wide** | a Workspace service account impersonating each user | delegation is granted org-wide in the Admin console; nothing to re-authorise |
| **My Drive** | the user who signed in | a stored refresh token |
| **Shared Folder** | the user who signed in | a stored refresh token |
| **Shared Drive** | the user who signed in | a stored refresh token |

**Domain Wide is the recommended choice for anything organisation-wide.** The
other three depend on one person's refresh token, and Google invalidates those on
password change, credential revocation, or when the account's session policy
expires them — so those connections stop working through no change on either side
and need re-authorising by that same person. Prefer Domain Wide unless the scope
really is one user's own folders.

Domain Wide also needs **Users Sampling Percent** (what share of users to scan)
and takes an optional `;`-delimited list of folders to exclude.

#### **For Google Drive Domain Wide Delegation:**

1. As a super admin of the Google Workspace, go to [admin.google.com](http://admin.google.com/).
2. On the left navbar, click on **Security**. If you don't see "Security", click on **Show more**.
3. Then click on **Access and data control.**
4. Click on **API Controls.**
5. The last card for **Domain wide delegation** has a "MANAGE DOMAIN WIDE DELEGATION" button, click it.
6. Select **Add new**, next to API clients.
7. Enter the Client ID, as mentioned below:
    - 110037688612688270977
8. For scopes, add these two, one at a time — they are the only scopes the
   integration requests:
    - `https://www.googleapis.com/auth/drive.readonly` — read file content and
      metadata.
    - `https://www.googleapis.com/auth/admin.directory.user.readonly` — list the
      users whose Drive is in scope. Domain-wide delegation impersonates each user
      in turn, so without this there is nobody to impersonate.

    Both are read-only. Relyance never requests `auth/drive` or any other
    write-capable Drive or Directory scope, so the integration cannot modify or
    delete anything in Drive.
9. Click **Authorize** to save.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936210189.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936210445.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936210701.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946017933.png)
![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936211213.png)
![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946019725.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34741936218637/42979035907341.png)

#### **In the Relyance AI application:**

1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Google Drive** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.

    ![Naming the new connection in the Add Connection dialog](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936213005.png)

7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see[Integration Features](/docs/introduction-to-relyance-ai/integration-features/).
8. In the **Connection** section, provide the appropriate values and click on **Continue**,
    - **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual** **Maps**, **Assets**, and **Data Flow Analysis** pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/).

    ![The Connection step: connection name, rescan frequency and Business Atlas associations](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936213901.png)

9. Select **Domain Wide** under **Authentication.**
    - Enter your google workspace associated domain under **Your Google Domain**
    - **(OPTIONAL)** Enter a list folder under **List the folders you want to exclude from the scan, delimited by ;**

    ![The Authentication step with Domain Wide selected, plus the domain and folder-exclusion fields](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936214157.png)

10. This step applies only if the **Data Inspection** check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on **Continue**,
    - **Minimum Confidence Level:** This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.
    - **Sampling Percentage:** This property adjusts the percentage of records using the table's row count (1000 records max) to return from a table.

    ![The Data Inspection step: minimum confidence level and sampling percent](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741946023693.png)

11. Review the configuration summary from the **Completion** section and click on **Finish.**

    ![The Completion summary, showing the scopes and endpoints the connection will use](https://assets.relyanceuat.xyz/images/docs/34741936218637/34741936214669.png)

12. Confirm the integration Status reflects **Connected.** Note:

As of today, only exact folder names, such as "Personal Folder" or "Other Folder," are verified by the platform. During the scanning process, it is checked whether any of these names appear in the excluded folders list. If they are listed, those folders are excluded. For instance, if two folders share the same name but are located in different paths, the specification of "Personal Folder" in the exclusion list results in both being excluded.

### Check the connection after setup

Open the connection to see what Relyance is authorised for and what the last scan
actually covered — a missing scope or a partial grant shows up here rather than as
an error:

![A connection's detail view: what Relyance is authorised for, and what the last scan covered](https://assets.relyanceuat.xyz/images/docs/ui/gdrive/08-connection-detail.png)

<!-- auth-methods:begin (generated from the integration catalog; do not hand-edit) -->

## Authentication methods and fields

Pick one of these under **Authentication Method** on the connection wizard's **Authentication** step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

| Method | Required | Optional |
| --- | --- | --- |
| **Domain Wide** | `Your Google Domain`, `Users Sampling Percent` | `List the folders you want to exclude from the scan, delimited by ;` |
| **My Drive** | `My Drive folders containing Contracts delimited by ;` | — |
| **Shared Folder** | `Shared folders containing Contracts delimited by ;` | — |
| **Shared Drive** | `Shared Drive Folders` (secret) | — |

<!-- auth-methods:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### OAuth (browser authorization) — Domain Wide

The **OAuth (browser authorization) — Domain Wide** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example gdrive/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth (browser authorization) — My Drive

The **OAuth (browser authorization) — My Drive** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example gdrive/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth (browser authorization) — Shared Folder

The **OAuth (browser authorization) — Shared Folder** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example gdrive/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth (browser authorization) — Shared Drive

The **OAuth (browser authorization) — Shared Drive** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example gdrive/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

<!-- terraform-examples:end -->