user_oauth_tokens
List OAuth tokens a user has granted to third-party apps, enabling detection of malicious apps using pre-authorized tokens for Gmail or Drive access without new login events.
Instructions
List third-party OAuth apps one user has granted account access to.
Account-compromise triage tool for the case login_audit and
suspended_accounts are both blind to: a malicious app used a
previously-granted OAuth token to read/delete mail or Drive files without
ever generating a fresh login event. Check each entry's scopes for
Gmail/Drive access on an unrecognized client_id/display_text —
Google's own apps (e.g. iOS/Android account sync) show up too and are
normal noise.
Read-only (Directory API tokens().list; never tokens().delete()).
Requires the admin.directory.user.security DWD scope — distinct from
admin.directory.user.readonly used by suspended_accounts; a domain
missing that grant returns {"error": ...}. No pagination: the API
returns a user's full grant list in one response.
Args:
username: Exact user email, passed through as the Directory API
userKey (primary or alias address both work on Google's side).
domain: Configured [domain.*] section to route the lookup through.
Default: resolved from the username's suffix. Set it explicitly
when the address uses an alias/secondary domain that has no
config section of its own (common when copying addresses from
mail headers or IdP logs).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | ||
| username | Yes |