> ## Documentation Index
> Fetch the complete documentation index at: https://docs.synk.to/llms.txt
> Use this file to discover all available pages before exploring further.

# GWS OAuth Scope Risk

> How Synk.to discovers Google Workspace OAuth grants and classifies every OAuth scope into Critical, High, Medium, and Low risk tiers.

Every time an employee clicks **"Sign in with Google"** or **"Allow"** on a third-party app, they grant that app a set of **OAuth scopes** — permissions to act on their Google Workspace data. Some scopes only reveal an email address; others let an app read every email, send mail as the user, or manage every account in your domain.

Synk.to classifies each Google Workspace OAuth scope by how much damage it could do in the wrong hands, and uses that classification to rate every discovered app and grant.

## How Synk.to discovers OAuth grants

Synk.to reads OAuth activity from the **Google Workspace Admin SDK Reports API** — the same audit log you see under *Reporting → Audit and investigation → OAuth log events* in the Google Admin console. For this, Synk.to requests the read-only `admin.reports.audit.readonly` scope when you [connect Google Workspace](/connect/google-workspace).

* **History** — on first connection, Synk.to looks back **6 months**, then keeps discovery up to date continuously.
* **Events** — app authorizations and OAuth token requests are recorded as grants; revocations are shown in each app's OAuth activity.
* **Per grant** Synk.to records the app name, OAuth client ID, the user who granted access, the scopes granted, the Google products and APIs the app used, and the IP address.

Events are grouped into **discovered systems** (one per app) with the full set of scopes, the list of users who granted access, and first/last seen dates. Operating system and browser clients (Chrome, Safari, Firefox, Edge, iOS, Android, macOS, Windows) are excluded, since they are not third-party apps.

## Scope risk tiers

Each scope is assigned to one of the following tiers:

| Tier                                 | What it means                                                                                                                                                                 |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <Badge color="red">Critical</Badge>  | Full control over a mailbox, all files, admin functions, or cloud infrastructure. A compromised app can exfiltrate or destroy data, impersonate users, or take over accounts. |
| <Badge color="orange">High</Badge>   | Broad read access to sensitive data (all email, all files, the employee directory, audit logs), or write access that can be abused for phishing or persistence.               |
| <Badge color="yellow">Medium</Badge> | Metadata, read-only access to a narrower data set, or limited write access. Useful for reconnaissance, but not full data access.                                              |
| <Badge color="green">Low</Badge>     | Sign-in and basic profile only, or UI integration with no data access.                                                                                                        |
| <Badge color="gray">Unknown</Badge>  | A scope Synk.to hasn't classified yet.                                                                                                                                        |

### Example scopes by tier

<Tabs>
  <Tab title="Critical">
    | Scope                                     | Label                   | Why it's risky                                                            |
    | ----------------------------------------- | ----------------------- | ------------------------------------------------------------------------- |
    | `https://mail.google.com/`                | Full Gmail access       | Complete IMAP/SMTP control — read, write, send, delete every email        |
    | `.../auth/gmail.send`                     | Send email as user      | Can send any email appearing to come from the user; invisible to the user |
    | `.../auth/drive`                          | Full Drive access       | Read, write, and delete every file and folder the user can access         |
    | `.../auth/admin.directory.user`           | Manage all domain users | Create, suspend, delete, and modify any user account in the organization  |
    | `.../auth/admin.directory.rolemanagement` | Assign admin roles      | Grant Super Admin or any delegated admin role to any user                 |
    | `.../auth/cloud-platform`                 | Full GCP access         | Unrestricted access to all Google Cloud infrastructure, secrets, and IAM  |
  </Tab>

  <Tab title="High">
    | Scope                             | Label                   | Why it's risky                                                            |
    | --------------------------------- | ----------------------- | ------------------------------------------------------------------------- |
    | `.../auth/gmail.readonly`         | Read all email          | Full mailbox content including body, attachments, and history             |
    | `.../auth/gmail.settings.sharing` | Set up email forwarding | Configure silent forwarding of all future email to an external address    |
    | `.../auth/drive.readonly`         | Read all Drive files    | Full read access to every file the user can see in Drive                  |
    | `.../auth/calendar`               | Full Calendar access    | Read, create, edit, and delete all events including private ones          |
    | `.../auth/admin.directory.group`  | Manage all groups       | Add/remove members from any group, controlling access to shared resources |
  </Tab>

  <Tab title="Medium">
    | Scope                              | Label                    | Why it's risky                                                       |
    | ---------------------------------- | ------------------------ | -------------------------------------------------------------------- |
    | `.../auth/gmail.metadata`          | Read email metadata      | From/To/Subject/Date for every email without body content            |
    | `.../auth/calendar.readonly`       | Read all calendar events | All event details including private events, attendees, and locations |
    | `.../auth/contacts.readonly`       | Read all contacts        | Full address book read: names, emails, phones across all contacts    |
    | `.../auth/drive.metadata.readonly` | Read Drive file metadata | File names, folder structure, sharing settings — no file content     |
  </Tab>

  <Tab title="Low">
    | Scope                        | Label                 | Why it's risky                                                       |
    | ---------------------------- | --------------------- | -------------------------------------------------------------------- |
    | `openid`                     | Authentication only   | Confirms identity via JWT; no profile information beyond a unique ID |
    | `email`                      | Email address         | Returns the user's primary email address only                        |
    | `profile`                    | Basic profile         | Display name and profile photo only                                  |
    | `.../auth/calendar.freebusy` | Free/busy status only | Whether a user is busy at a given time; no event details             |
  </Tab>
</Tabs>

`.../auth/` stands for `https://www.googleapis.com/auth/`. Synk.to classifies close to 60 Google Workspace scopes across Gmail, Drive, Calendar, Contacts, Docs, Sheets, Slides, Forms, Chat, Tasks, Admin SDK, Google Analytics, Tag Manager, and Google Cloud. In the app, each scope is shown as a colored chip with its label — hover over it to see the full scope.

<Note>
  The scope classification is maintained by Synk.to and applies to all customers. If you think a scope is misclassified, or you see an important scope marked as Unknown, let us know at [support@synk.to](mailto:support@synk.to).
</Note>

## How an app's risk is calculated

Risk is driven by the **most dangerous permission**, not by the number of permissions:

1. **Grant risk** — each user's grant takes the **highest** tier among its scopes. A grant with `openid`, `email`, and `gmail.send` is Critical, because a single Critical scope is enough to cause a Critical incident. Unknown scopes never raise a grant above its known scopes.
2. **App scope risk** — a discovered app takes the highest tier across all of its users' grants. If one user granted an app full Drive access, the app is rated for full Drive access.
3. **Final risk** — the app's scope risk is combined with the [vendor risk](/getting-started/vendor-risk-assessment) of the company behind it, and the **higher of the two wins**. A Low-scope app built by a Critical-risk vendor is Critical; a Critical-scope app from a Very Low-risk vendor is still Critical.

Hover over any **Risk** badge on the Systems or Discovered systems page to see the breakdown: **Vendor**, **OAuth scopes**, and **Final**. Use the **OAuth risk** and **Vendor risk** filters to narrow the list by either dimension.

## Alerts and weekly digest

Scope risk also drives Synk.to's notifications:

* **Alerts** — two alert rules are enabled by default with a **High or above** threshold, which you can change on the Alerts page:
  * **New risky system discovered** — a new app appears whose scopes meet the threshold.
  * **New user provided risky scope** — a user grants an existing app scopes they didn't hold before, and those scopes meet the threshold.
* **Weekly digest** — the *Risky authorization activity* sections list every new authorization in the past week that includes at least one High or Critical scope, split into:
  * apps that have an owner or come from a lower-risk vendor, and
  * apps from **unknown or high-risk vendors** — the ones to review first.

<Tip>
  Synk.to surfaces risky grants but doesn't revoke them. To remove an app's access, go to *Security → Access and data control → API controls → Manage third-party app access* in the Google Admin console, where you can block the app or revoke its tokens.
</Tip>