# Workspace Verify

> Get a Google Workspace integration through OAuth verification and Marketplace review. Paste the OAuth scopes your
> integration declares in code or its manifest, in the Marketplace SDK and on the consent screen, add a feature note
> per scope, answer a short interview, and the browser checks the scope tiers, the drift between the three places and
> the verification gates; then the metered runs write the scope table with a justification per scope and the dated
> plan, or the fixes for a rejected review. Built on the SkillSafe skill
> @samber/google-workspace-marketplace-playbook, from samber/developer-platform-skills (MIT), by Samuel Berthe.
> Not affiliated with or endorsed by Google.
> Scope: a SaaS vendor's Google Workspace integration - a web app calling Google APIs, a Workspace add-on, an Editor
> add-on, a Chat app, a Drive app, or a Chrome extension's Google API scopes - not listing copy, not your own API's
> OAuth, not internal-only apps.

https://gws-verify.skillsafe.ai/

## What is free
- Reading scopes: full scope URLs (https://www.googleapis.com/auth/..., https://mail.google.com/) anywhere in appsscript.json, a JSON or plain list, or code; a short form such as gmail.send or drive.file when it is a whole quoted string, a whole list line, or a scope the ladder names. Every scope is normalized to its short form.
- Tiers from a fixed enum, taken from the skill's scope ladder only: nonsensitive (drive.file, gmail.addons.current.message.action, gmail.addons.current.action.compose, gmail.labels, chat.bot, drive.install), sensitive (gmail.send, gmail.addons.current.message.readonly, gmail.addons.current.message.metadata, most Calendar and Contacts scopes), restricted (mail.google.com, gmail.readonly, gmail.modify, gmail.compose, gmail.metadata, gmail.settings.basic, drive, drive.readonly, drive.metadata.readonly, drive.activity, chat.messages, chat.messages.readonly). Any other scope is unknown - read the API's scope page; never guessed.
- The scope table: each scope's tier, where it is declared (code, SDK, consent screen), the drift, its feature note, and the read-only variant when the note says read-only but a write scope is used.
- The checks, each with an id, the skill's rule and pass, fix, fail, n/a or note: drift and lists_pasted (rule 3); feature_notes and readonly (rule 2); tier_known, restricted, casa and script_outbound (rule 1); limited_use_ai and limited_use (rule 5); internal_multi, testing_status and user_cap (route); project_owner, granular and launch_window (sequence); demo_video and test_account (packet); chat_install and visibility (listing).
- Do you need a listing: a verified OAuth client with no listing, a public listing with Individual + Admin install, or a public listing with Admin Only install - re-ranked by the surface and who installs.
- The dated sequence: from the launch backward (or from today), one rejection round, the slower of verification and listing setting the date; CASA last for restricted scopes.
- Exports: the scope table (.csv, with a justification column), the checks (.csv), the three-place scope list - the reconciled minimal list to paste identically into all three places (.txt) - and everything (.json).
- Every Google figure carries a dagger: up to 10 days†, several weeks†, every 12 months†, 100 users†, 7 days†, 2-4 weeks†, AL1 or AL2†, 2-6 weeks†, 6 weeks†. † verify against current Google docs; Google renamed the security assessment's levels and moved verification timelines within a year.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (plan or fixes), `integration`, `scopes`, `features`, `review` (fixes only: the review document), `carry` (fixes only: the plan's scope table) and `facts`.
- `plan` replies with `summary`, `rung` (`scopes` nonsensitive, sensitive or restricted; `listing` client_only, public_both or public_admin; `why`), `scopes` (`scope`, `tier`, `justification`, `action` keep, narrow or drop, `narrower`), `fixes` (`check`, `change`), `sequence` (`step`, `owner`, `wait`), `footnote` and `caveats`.
- `fixes` replies with `summary`, `points` (`n`, `review`, `fix`, `check`), `resubmit` (`gate` verification, casa or marketplace; `clock`; `when`), `reply`, `footnote` and `caveats`.
The page holds every reply to its own facts: the plan keeps the page's highest tier and listing rung (a moved rung is put back), gives every page scope exactly one row and invents none, keeps every tier, names only the ladder's scopes as narrower, writes a distinct justification per scope and carries every fail check as a fix; the fixes lane answers at least as many points as the document numbers, names the page's gate, says the review pauses until you reply and resubmits once, and its reply lists every point, never argues and never asks to expedite; both carry the dagger on every figure, the footnote, no URL (scopes in short form), no backticks and no claim of Google endorsement.

## Links
- API tutorial: https://gws-verify.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/google-workspace-marketplace-playbook
- Source repository: https://github.com/samber/developer-platform-skills