> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/help/troubleshooting/integration-issues/google-integration-errors.md).

# Google integration errors

Troubleshooting errors for the Google Workspace integration include the following:

## ID error

After integrating DoControl with Google Workspace, you get the following error message:

`Failed createIntegrationV2, companyId: XXX, error: TypeError: Cannot read property 'id' of undefined`

#### **How to solve this issue**

Make sure that at least one group exists in the Workspace tenant for it to connect successfully.

## Service account was not set up correctly

DoControl cannot make API calls on behalf of users in your organization. Make sure that you created a new API client with domain-wide delegation.

#### **How to solve this issue**

1. Copy the client ID
   1. In Google Cloud console, navigate to **IAM & Admin** and select your project.
   2. From the top menu, click the **Details** tab.
   3. Select **Show advanced settings > Domain-wide delegation,** and copy the client ID.<br>
2. Paste the client ID
   1. Log into the Google Admin console.
   2. Navigate to **Security > API Controls > Domain-wide delegation.**
   3. From the top menu, click **Add new**.
   4. In the Client ID field, paste the client ID that you copied in the previous step.<br>

## Service account doesn't exist

DoControl is unable to use the provided service account. Make sure the service account exists and is enabled.

#### **How to solve this issue**

Enable the service account you created.

1. Create a new project in Google Cloud Platform (GCP)
2. In Google Cloud console, enable these APIs:
   * Google Drive API
   * Admin SDK API
   * Drive Labels API

## Admin SDK is disabled

The Admin SDK API was not enabled in the Google Cloud console.

#### **How to solve this issue**

Make sure you enable the Admin SDK API.

1. In Google Cloud console, navigate to the [APIs & services](https://console.cloud.google.com/projectselector2/apis/dashboard?supportedpurview=project) dashboard, and select the project for configuring the service account.
2. From the top menu, click + Enable APIs and services. The API library opens.
3. From the search bar, search and select the Admin SDK API.
4. Click Enable and verify that the API is enabled.

## Cannot read events

The user performing the integration does not have the admin privileges required to read activity records.

**How to solve this issue**

Make sure that the custom admin user was granted the required roles.

1. In[ Google Admin Console](https://admin.google.com/u/2/ac/users), create a new custom admin account.
2. Assign the following privileges and then click **Create role:**\
   Admin Console > Reports
3. Make sure that all **Read** scopes are granted to the service account.&#x20;

## Google Drive API is disabled

The Google Drive API was not enabled in the Google Cloud console.

**How to solve this issue**

Make sure you enable the Google Drive API.

1. In Google Cloud console, navigate to the [APIs & services](https://console.cloud.google.com/projectselector2/apis/dashboard?supportedpurview=project) dashboard, and select the project for configuring the service account.
2. From the top menu, click **+** **Enable APIs and services**. The API library opens.
3. From the search bar, search and select the **Google Drive API**.
4. Click **Enable** and verify that the API is enabled.<br>

## Cannot get apps

The user performing the integration is not a super admin, and does not have the required service account scope to list apps.

**How to solve this issue**

1. Create a super admin user.
2. Copy and paste the snippet with the required scopes for shadow apps:
   * <https://www.googleapis.com/auth/admin.directory.user.security>
   * <https://www.googleapis.com/auth/drive.apps.readonly>

## Cannot get domains

The custom admin performing the integration does not have the required admin privilege to list domains.

**How to solve this issue**

Make sure you assign Domain Management privileges to the custom admin user you created.<br>

1. Set up a custom admin user in Google Admin console.

2. Assign the following privileges and then click **Create role:**
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read

3. Assign role\
   Go to **Users > Click the user > Assign role**<br>

4. Log into Google Workspace\
   As the custom admin user, log in at least once.<br>

5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.<br>

## Cannot get files

The custom admin performing the integration does not have the required admin privilege to list files.

**How to solve this issue**

Make sure you assign Drive and Docs privileges to the custom admin user you created.<br>

1. Set up a custom admin user in Google Admin console.
2. Assign the following privileges and then click **Create role**:
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read<br>
3. Assign role\
   Go to **Users > Click the user > Assign role**<br>
4. Log into Google Workspace\
   As the custom admin user, log in at least once<br>
5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.

## Cannot get labels

The Drive labels API was not enabled in the Google Cloud console.

**How to solve this issue**

Make sure the Drive labels API is enabled.<br>

1. In Google Cloud console, navigate to the [APIs & services](https://console.cloud.google.com/projectselector2/apis/dashboard?supportedpurview=project) dashboard, and select the project for configuring the service account.
2. From the top menu, click **+ Enable APIs and services.** The API library opens.
3. From the search bar, search and select the **Drive labels API**.
4. Click **Enable** and verify that the API is enabled.<br>

## Cannot get groups

The custom admin performing the integration does not have the required admin privilege to list groups.

**How to solve this issue**

Make sure you assign Group privileges to the custom admin user you created.<br>

1. Set up a custom admin user in Google Admin console.
2. Assign the following privileges and then click **Create role**:
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read<br>
3. Assign role\
   Go to **Users > Click the user > Assign role**<br>
4. Log into Google Workspace\
   As the custom admin user, log in at least once.<br>
5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.<br>

## Cannot get group members

The custom admin performing the integration does not have the required admin privilege to list group members.

**How to solve this issue**

Make sure you assign **Group and User** privileges to the custom admin user you created.<br>

1. Set up a custom admin user in Google Admin console
2. Assign the following privileges and then click **Create role**:
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read<br>
3. Assign role\
   Go to **Users > Click the user > Assign role**<br>
4. Log into Google Workspace\
   As the custom admin user, log in at least once<br>
5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.<br>

## Cannot get shared drives

The custom admin performing the integration does not have the required admin privilege to list shared drives.

**How to solve this issue**

Make sure you assign Drive and Docs privileges to the custom admin user you created.<br>

1. Set up a custom admin user in Google Admin console.
2. Assign the following privileges and then click **Create role**:
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read<br>
3. Assign role\
   Go to **Users > Click the user > Assign role**.<br>
4. Log into Google Workspace.\
   As the custom admin user, log in at least once.<br>
5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.

## Cannot access security tokens

The custom admin performing the integration does not have the required admin privilege to access security tokens.

**How to solve this issue**

The user performing the integration is not a super admin, and does not have the required service account scope to access security tokens.<br>

1. Create a super admin user.
2. Copy and paste the snippet with the required scopes for shadow apps:
   * <https://www.googleapis.com/auth/admin.directory.user.security>
   * <https://www.googleapis.com/auth/drive.apps.readonly>

## Cannot find specified org units

The Org Unit path is not correct.

**How to solve this issue**

Make sure the org unit path is correct and you enter it in the correct syntax.<br>

1. To extract the organizational unit path, visit the [org unit settings ](https://admin.google.com/ac/orgunits)in your admin panel.
2. In **Define scopes**, enter the organizational unit using this syntax:\
   /sub\_ou/sub\_sub\_ou/user\_orgunit

## Cannot get users

The custom admin performing the integration does not have the required admin privileges to list users.

**How to solve this issue**

Make sure you assign **User** privileges to the custom admin user you created.

1. Set up a custom admin user in Google Admin console.
2. Assign the following privileges and then click **Create role**:
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read<br>
3. Assign role\
   Go to **Users > Click the user > Assign role**.<br>
4. Log into Google Workspace.\
   As the custom admin user, log in at least once<br>
5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.

## User is not admin

The user performing the integration does not have the required admin privileges.

**How to solve this issue**

Make sure you created a custom admin user with the required permissions.

1. Set up a custom admin user in Google Admin console.
2. Assign the following privileges and then click **Create role**:
   * Admin Console > Reports
   * Admin Console > Services > Drive and Docs > Settings
   * Admin API > Users > Read
   * Admin API > Domain management
   * Admin API > Groups > Read
   * Admin API > Organization units > Read<br>
3. Assign role\
   Go to **Users > Click the user > Assign role**.<br>
4. Log into Google Workspace\
   As the custom admin user, log in at least once.<br>
5. Define the custom admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create custom admin user**.

## User is not super admin

The user performing the integration does not have the required super admin privileges. To install the shadow app module, you must be a super admin user.

**How to solve this issue**

Make sure you created a super admin user.&#x20;

1. Set up a super admin user in Google Admin console\
   Make sure you assign the **super admin** role to the admin user.<br>
2. Log into Google Workspace\
   As the super admin user, log in at least once.<br>
3. Define the super admin email\
   Assign an email to use with your service account.\
   In the integration wizard, go to **Create super admin user**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/help/troubleshooting/integration-issues/google-integration-errors.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.