Google Workspace Alert Center API
Browse all Google APIs✓ Official Vendor SpecSecurityThreat Detectionoauth211 EndpointsREST
For Agents
List, fetch, and triage Google Workspace security alerts (phishing, malware, suspicious sign-ins) across a customer domain.
Use for: List Google Workspace alerts of type 'Phishing' raised in the last 24 hours, Get the full alert body for a specific alertId including affected user accounts, Retrieve metadata for an alert to check its current triage state, Submit feedback marking a Workspace alert as VERY_USEFUL
Not supported: Does not handle Workspace user provisioning, admin audit logs, or detection rule configuration — use for reading and triaging Workspace security alerts only.
The Google Workspace Alert Center API exposes alerts about issues affecting a Workspace domain — phishing campaigns, suspicious account activity, malware, account compromise, and policy violations — that Google's security systems flag. It supports listing, retrieving, undeleting, and batch-deleting alerts, attaching analyst feedback, and reading per-alert metadata. It is intended for security teams that want Workspace alerts pulled into their SIEM or SOAR rather than triaged in the Alert Center web UI.
Install Jentic One Beta
Connect the Google Workspace Alert Center API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Google Workspace Alert Center API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Google Workspace Alert Center API.
List Workspace security alerts filtered by type, source, and time range
Retrieve the full payload of a single alert including the affected users and Google's analysis
Attach analyst feedback (NOT_USEFUL, SOMEWHAT_USEFUL, VERY_USEFUL) to an alert for tuning
Batch-delete or batch-undelete alerts to clear or restore noisy detections
Read per-alert metadata to track triage status across the security team
Update domain-level Alert Center settings such as notification recipients
Use Cases
Patterns agents use Google Workspace Alert Center API for, with concrete tasks.
★ Workspace Alerts in a SIEM
Security teams want every Workspace security alert (phishing, suspicious sign-in, malware) to land in their SIEM alongside endpoint and identity alerts. The Alert Center API is the only programmatic surface for these — they cannot be pulled from the audit log alone. A poller lists new alerts, GETs each by ID, and forwards the structured payload to the SIEM. The 11 endpoints cover list, get, feedback, metadata, undelete, batchDelete and batchUndelete.
GET /v1beta1/alerts with a filter on createTime greater than the last watermark, then GET /v1beta1/alerts/{alertId} for each new ID and ship the result as a SIEM event.
Analyst Feedback Loop
Security operations teams want to tell Google which Workspace alerts were useful so detections improve over time. The createFeedback endpoint attaches a feedback rating to an alert. Combined with metadata reads, this lets a SOAR playbook record a triage decision and submit feedback in the same step rather than asking analysts to leave the SIEM and click in the Alert Center UI.
After an analyst dispositions an alert in the SOAR, POST to /v1beta1/alerts/{alertId}/feedback with type=VERY_USEFUL or NOT_USEFUL and an email of the submitting analyst.
Bulk Alert Cleanup
When a misconfigured rule fires hundreds of false-positive alerts, security teams need a fast way to clear them and a safe way to restore them if needed. batchDelete soft-deletes a list of alert IDs and batchUndelete restores them. This avoids hand-clicking through pages of Alert Center entries when a noisy detection misfires.
POST /v1beta1/alerts:batchDelete with the list of alertIds for the misfiring detection, and on confirmation that the rule was wrong call /v1beta1/alerts:batchUndelete with the same list.
Agent-Triaged Workspace Alerts
An agent integrating Alert Center via Jentic can search for the listing operation, fetch each alert, summarise it with a language model, and post a triage suggestion to chat. Jentic isolates the Workspace OAuth credential and exposes only the alert payload schema, so the workflow runs without a custom OAuth implementation. Setup time drops from a couple of days to under an hour.
Use the Jentic search query 'list Google Workspace security alerts' to discover the operation, then list new alerts, fetch each by ID, summarise the data block, and post a structured triage card to Slack.
Key Endpoints
11 endpoints — the google workspace alert center api exposes alerts about issues affecting a workspace domain — phishing campaigns, suspicious account activity, malware, account compromise, and policy violations — that google's security systems flag.
METHOD
PATH
DESCRIPTION
GET
/v1beta1/alerts
List alerts for a Workspace customer with optional filter and orderBy
GET
/v1beta1/alerts/{alertId}
Get a single alert by ID
POST
/v1beta1/alerts/{alertId}/feedback
Attach analyst feedback to an alert
GET
/v1beta1/alerts/{alertId}/metadata
Get triage metadata for an alert
POST
/v1beta1/alerts:batchDelete
Soft-delete a batch of alerts
POST
/v1beta1/alerts:batchUndelete
Restore a previously deleted batch of alerts
GET
/v1beta1/alerts
List alerts for a Workspace customer with optional filter and orderBy
GET
/v1beta1/alerts/{alertId}
Get a single alert by ID
POST
/v1beta1/alerts/{alertId}/feedback
Attach analyst feedback to an alert
GET
/v1beta1/alerts/{alertId}/metadata
Get triage metadata for an alert
POST
/v1beta1/alerts:batchDelete
Soft-delete a batch of alerts
POST
/v1beta1/alerts:batchUndelete
Restore a previously deleted batch of alerts
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Alert Center uses OAuth 2.0, typically via a Workspace domain-wide delegated service account. Jentic stores the service account JSON encrypted in the MAXsystem vault and issues short-lived access tokens to the agent, so keys never appear in agent context.
Intent-based discovery
Agents search Jentic with intents like 'list Google Workspace security alerts' and Jentic returns the matching alerts.list operation along with its filter and pagination schema.
Time to first call
Direct integration takes 1-2 days for service account delegation, OAuth, and pagination. Through Jentic the same workflow runs in under an hour.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Google Workspace Alert Center API through Jentic.
What authentication does the Alert Center API use?
OAuth 2.0 with the apps.alerts scope, typically via a Workspace domain-wide delegated service account so the API can read alerts for the customer. Jentic stores the service account JSON in its encrypted vault and minted access tokens are short-lived, so secrets never enter agent context.
Can I forward every Workspace phishing alert into my SIEM?
Yes. Call /v1beta1/alerts with a filter such as type="Phishing message detected post-delivery" AND createTime>="...", then GET /v1beta1/alerts/{alertId} for each result and post the payload as a SIEM event.
What are the rate limits for the Alert Center API?
Alert Center is governed by the standard Google Workspace API per-project quota. Default quota covers normal SIEM polling intervals; high-frequency polling may need a quota increase via the Google Cloud Console quotas page for the Alert Center API.
How do I submit analyst feedback on an alert through Jentic?
Search Jentic for 'submit feedback on a Google Workspace alert', load the schema for /v1beta1/alerts/{alertId}/feedback, and POST with type and email. Run pip install jentic and the async search, load, execute pattern.
Does the Alert Center API let me change which alerts Google generates?
No. The detection rules are owned by Google. The API lets you list alerts, attach feedback, manage triage state, and update domain-level notification settings, but it does not configure detection logic itself.
Why is this API marked v1beta1?
Google has shipped Alert Center as v1beta1 for an extended period and treats it as production-grade for Workspace customers. The endpoint paths in this enrichment reflect the v1beta1 paths the API actually exposes.
GET STARTED