Google DWD
Configure, test, and enable Google domain-wide delegation.
Endpoints under /api/v1/google-dwd. Every call needs a workspace API key and an Admin or
Owner workspace role. If FLUXUS_GOOGLE_DWD is not the string true, all handlers return
404.
Endpoints
| Method | Path | Description |
|---|---|---|
| GET | /api/v1/google-dwd | List configs in the API-key workspace |
| POST | /api/v1/google-dwd | Create a fixed-subject config |
| PATCH | /api/v1/google-dwd/{id} | Enable or disable after a successful test |
| POST | /api/v1/google-dwd/{id}/test | Exchange a JWT and GET the Gmail profile |
Create
{
"credentialId": "cred_sa",
"subject": "inbox@example.com",
"scopes": [
"https://www.googleapis.com/auth/gmail.readonly",
"https://www.googleapis.com/auth/gmail.send"
]
}
201 returns { config } with enabled: false and testStatus: "pending". Validation errors
(missing fields, bad email, scopes outside the allowlist, immutable-scope conflict) return 400.
Responses never include client_email, private_key, or access tokens.
Test and enable
POST /api/v1/google-dwd/{id}/test returns { config } after a successful profile check, or
400 with the provider/test error. Failed tests set testStatus: "failed" and enabled: false.
PATCH body must include boolean enabled. Enablement without testStatus: "succeeded" returns
400 (A successful DWD test is required before enablement.).
Mailer binding
See PATCH /api/v1/mailer/routes/{id}/google-dwd and polling-group googleDwdConfigId in the
Mailer API. Conceptual setup is in
Google Domain-Wide Delegation.