[ Web Proxy ]
URL:
Viewing: https://developers.google.com/workspace/cse/reference [Back]  [Original]
Google Workspace CSE API Reference  |  Google for Developers Skip to main content
Google Workspace [Google Workspace]
Home All products Resources
Search:
Overview Explorer Guides Support
Google Workspace [Google Workspace]
Send feedback

Google Workspace CSE API Reference Stay organized with collections Save and categorize content based on your preferences.

outlined_flag

The Google Workspace Client-side Encryption (CSE) API lets you own the encryption keys used to further encrypt Google Workspace data.

Methods

Methods
delegate POST https://KACLS_URL/delegate
Allows a first user to delegate a request to a second user.
digest POST https://KACLS_URL/digest
Returns the checksum of an unwrapped DEK.
privatekeydecrypt POST https://KACLS_URL/privatekeydecrypt
Unwraps a wrapped private key and then decrypts the content encryption key that is encrypted to the public key.
privatekeysign POST https://KACLS_URL/privatekeysign
Unwraps a wrapped private key and then signs the digest provided by the client.
privilegedprivatekeydecrypt POST https://KACLS_URL/privilegedprivatekeydecrypt
Decrypts without checking the wrapped private key ACL.
privilegedunwrap POST https://KACLS_URL/privilegedunwrap
Decrypts data exported from Google in a privileged context.
privilegedwrap POST https://KACLS_URL/privilegedwrap
Returns a wrapped Data Encryption Key (DEK) and associated data.
rewrap POST https://KACLS_URL/rewrap
Re-encrypts an encrypted DEK.
status GET https://KACLS_URL/status
Checks the status of a Key Access Control List Service (KACLS).
unwrap POST https://KACLS_URL/unwrap
Returns decrypted DEK.
wrap POST https://KACLS_URL/wrap
Returns encrypted DEK and associated data.
wrapprivatekey POST https://KACLS_URL/wrapprivatekey
Wraps a user's private key.

Tokens

Tokens
Authorization JWT issued by Google to verify that the caller is authorized to encrypt or decrypt a resource.
 
Authentication JWT issued by the identity provider that attests user identity.
 

Other

Send feedback

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-07-22 UTC.

Need to tell us more? [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-07-22 UTC."],[],["The Google Workspace CSE API enables key ownership for encrypting Workspace data. Key actions include: `digest` to return checksums, `privatekeydecrypt` to decrypt keys, `privatekeysign` to sign digests, `unwrap`/`wrap` to decrypt/encrypt DEKs, `rewrap` to re-encrypt DEKs, `privileged` methods for special decryption/wrapping, `wrapprivatekey` to wrap a user's private key and `status` to check the Key Access Control List Service. It uses `Authorization` and `Authentication` JWT tokens and details structured error handling.\n"]]
Web Proxy Viewer  |  New URL  |  Original Page