Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt

Use this file to discover all available pages before exploring further.

Google Mail The Google Mail app provides read/write access to a user’s Gmail mailbox through the Gmail REST API v1. It can be used either as a Builder app (automations call Gmail instructions directly) or as a remote MCP server consumed by an AI agent. Each tenant configures its own Google OAuth Application; end-users sign in with their own Google account and tokens are stored per (user × tenant). The connector exposes 68 underlying operations, grouped into 13 entity tools covering messages, threads, drafts, labels, attachments, history, profile, settings, filters, forwarding addresses, send-as aliases, S/MIME and delegates.

Messages & Threads

List, search, read, send, label, trash, untrash and modify messages, threads and attachments

Mailbox Settings

Vacation responder, filters, forwarding, IMAP/POP, language and history streaming

Identities & Delegates

Send-as aliases, S/MIME certificates and account-wide delegates

Prerequisites

  • A Google account with access to the mailbox you want to expose. For Google Workspace mailboxes, the workspace admin may need to allow third-party OAuth apps.
  • A Google Cloud project with the Gmail API enabled at console.cloud.google.com/apis/library/gmail.googleapis.com.
  • A Google OAuth 2.0 Client of type Web application, created at console.cloud.google.com/apis/credentials. The Authorized redirect URIs must contain the value shown in the OAuth Callback URL field of the installed app instance (auto-populated on install — copy it back into the Google Cloud Console after installation).
  • An OAuth consent screen configured in the Google Cloud project. While the app is in Testing state, add the end-user’s email to Test users. The full mailbox scope (https://mail.google.com/) is classed restricted by Google and requires CASA verification when the consent screen moves to Production.
  • Base URL (default: https://gmail.googleapis.com)

Installation

  1. Go to Apps in your workspace
  2. Search for Google Mail and install it
  3. Open the app instance configuration and fill in the required fields

Configuration

FieldDescription
Gmail API Base URLBase URL of the Gmail API (default https://gmail.googleapis.com)
API Token (fallback)Optional static OAuth access token used as a shared fallback for all users of this tenant. Stored as a workspace secret. Most deployments leave this empty and rely on per-user OAuth instead.
OAuth2 Client IDGoogle OAuth Application Client ID. Create an OAuth client of type Web application in the Google Cloud Console
OAuth2 Client SecretGoogle OAuth Client Secret, stored as a workspace secret
OAuth Callback URLAuto-populated on install — paste this value into the Authorized redirect URIs list of your Google OAuth client
OAuth Authorize URLDefault https://accounts.google.com/o/oauth2/v2/auth
OAuth Token URLDefault https://oauth2.googleapis.com/token
OAuth Revoke URLDefault https://oauth2.googleapis.com/revoke
OAuth ScopesSpace-separated Google API scopes. Default https://mail.google.com/ (full mailbox access). Other common values: gmail.readonly, gmail.send, gmail.modify, gmail.labels, gmail.settings.basic
Refresh Token TTL (seconds)Default 15552000 (180 days, Google’s max)
Max Tool Payload (KB)Threshold above which MCP responses are auto-compacted into a summary + recovery hints to avoid overflowing the LLM context. Default 50. Raise it (for example 200) when targeting LLMs with 1M-token windows
MCP EndpointAuto-populated on install — URL of the MCP endpoint for this instance
MCP API KeyAuto-populated on install — signed key used in the mcp-api-key header. Do not modify
MCP Endpoint, MCP API Key and OAuth Callback URL are generated automatically by the onInstall flow. The OAuth credentials below (OAuth2 Client ID, OAuth2 Client Secret) must be filled in manually after creating the OAuth client in the Google Cloud Console.

Authorize end-users

Once the app instance is configured, each end-user authorizes their own Google account through a browser-based consent screen:
1

Trigger the connect flow

From an MCP client (Agent Creator capability or any tool client), call any data tool. If no OAuth session exists for the current user × tenant, the MCP server returns a connector_auth_required payload with a connect_url. Alternatively, call the connect tool explicitly to receive the same payload.
2

Open the connect URL

Open the returned URL in a browser tab where the user is already authenticated to Prisme.ai. The platform redirects to the Google OAuth consent screen.
3

Grant access

The user reviews the requested scopes (default https://mail.google.com/) and clicks Allow. Google redirects back to the platform’s oauthCallback webhook.
4

Confirmation

The user sees a Connection complete page and can close the tab. The platform has stored an access token plus refresh token as user-scoped secrets — both are tenant-prefixed so they do not leak across app instances.
Each user’s OAuth tokens are scoped per (user × tenant). A user who has authorized in tenant A does not gain access in tenant B — they must run the connect flow again per app instance. Refresh tokens are rotated by Google on each refresh and live up to 180 days when idle.

Available Instructions

Every instruction resolves credentials from the workspace configuration. The userId argument defaults to me (the authenticated end-user) — pass an explicit email address only when calling on behalf of a delegated account. Most list operations accept maxResults (default 100) and pageToken for pagination, plus a Gmail-style q query string for filtering.

Messages

InstructionArguments
listMessagesuserId, maxResults, pageToken, q, labelIds, includeSpamTrash
getMessageuserId, id*, format (minimal/metadata/full/raw), metadataHeaders
sendMessageuserId, raw*, threadId, labelIds, payload
insertMessageuserId, raw*, threadId, labelIds, payload, internalDateSource, deleted
importMessageuserId, raw*, threadId, labelIds, payload, internalDateSource, neverMarkSpam, processForCalendar, deleted
deleteMessageuserId, id*
trashMessageuserId, id*
untrashMessageuserId, id*
modifyMessageuserId, id*, addLabelIds, removeLabelIds
batchModifyMessagesuserId, ids*, addLabelIds, removeLabelIds
batchDeleteMessagesuserId, ids*

Threads

InstructionArguments
listThreadsuserId, maxResults, pageToken, q, labelIds, includeSpamTrash
getThreaduserId, id*, format, metadataHeaders
deleteThreaduserId, id*
trashThreaduserId, id*
untrashThreaduserId, id*
modifyThreaduserId, id*, addLabelIds, removeLabelIds

Attachments

InstructionArguments
getAttachmentuserId, messageId, id

Drafts

InstructionArguments
listDraftsuserId, maxResults, pageToken, q, includeSpamTrash
getDraftuserId, id*, format
createDraftuserId, message*
updateDraftuserId, id, message
deleteDraftuserId, id*
sendDraftuserId, id*, message

Labels

InstructionArguments
listLabelsuserId
getLabeluserId, id*
createLabeluserId, name*, labelListVisibility, messageListVisibility, color, type
updateLabeluserId, id*, name, labelListVisibility, messageListVisibility, color, type
patchLabeluserId, id*, name, labelListVisibility, messageListVisibility, color, type
deleteLabeluserId, id*

History

InstructionArguments
listHistoryuserId, startHistoryId*, maxResults, pageToken, labelId, historyTypes

Profile & Push Notifications

InstructionArguments
getProfileuserId
watchInboxuserId, topicName*, labelIds, labelFilterAction, labelFilterBehavior
stopWatchuserId

Settings

InstructionArguments
getAutoForwardinguserId
updateAutoForwardinguserId, enabled, emailAddress, disposition
getImapuserId
updateImapuserId, enabled, autoExpunge, expungeBehavior, maxFolderSize
getLanguageuserId
updateLanguageuserId, displayLanguage*
getPopuserId
updatePopuserId, accessWindow, disposition
getVacationuserId
updateVacationuserId, enableAutoReply, responseSubject, responseBodyPlainText, responseBodyHtml, restrictToContacts, restrictToDomain, startTime, endTime

Filters

InstructionArguments
listFiltersuserId
getFilteruserId, id*
createFilteruserId, criteria, filterAction
deleteFilteruserId, id*

Forwarding Addresses

InstructionArguments
listForwardingAddressesuserId
getForwardingAddressuserId, forwardingEmail*
createForwardingAddressuserId, forwardingEmail*
deleteForwardingAddressuserId, forwardingEmail*

Send-As Aliases

InstructionArguments
listSendAsuserId
getSendAsuserId, sendAsEmail*
createSendAsuserId, sendAsEmail*, displayName, replyToAddress, signature, isPrimary, treatAsAlias, smtpMsa
updateSendAsuserId, sendAsEmail*, displayName, replyToAddress, signature, isPrimary, treatAsAlias, smtpMsa
patchSendAsuserId, sendAsEmail*, displayName, replyToAddress, signature, isPrimary, treatAsAlias, smtpMsa
deleteSendAsuserId, sendAsEmail*
verifySendAsuserId, sendAsEmail*

S/MIME

InstructionArguments
listSmimeInfouserId, sendAsEmail*
getSmimeInfouserId, sendAsEmail, id
insertSmimeInfouserId, sendAsEmail, pkcs12, encryptedKeyPassword
deleteSmimeInfouserId, sendAsEmail, id
setDefaultSmimeInfouserId, sendAsEmail, id

Delegates

InstructionArguments
listDelegatesuserId
getDelegateuserId, delegateEmail*
createDelegateuserId, delegateEmail*, verificationStatus
deleteDelegateuserId, delegateEmail*
Arguments flagged with * are required. The userId argument defaults to me — leave it empty unless you explicitly need to address a delegated mailbox.

DSUL Examples

List the latest unread messages in the inbox

- GoogleMail.listMessages:
    q: in:inbox is:unread
    maxResults: 10
    output: inbox

Send a plain-text email

The Gmail API requires the message as a base64url-encoded RFC 2822 string. Build the MIME body in Custom Code first, then pass it as raw.
- Custom Code.run:
    function: base64url
    parameters:
      value: |
        From: me
        To: alice@example.com
        Subject: Status update

        Hello Alice,
        Here is the weekly summary.
    output: rawEmail
- GoogleMail.sendMessage:
    raw: '{{rawEmail}}'
    output: sent

Apply a label to a thread

- GoogleMail.modifyThread:
    id: '{{thread_id}}'
    addLabelIds:
      - IMPORTANT
    removeLabelIds:
      - UNREAD
    output: modified

Enable an out-of-office responder

- GoogleMail.updateVacation:
    enableAutoReply: true
    responseSubject: I am out of office
    responseBodyHtml: |
      <p>I am away until April 15. For urgent matters, please contact alice@example.com.</p>
    restrictToContacts: false
    startTime: '1739923200000'
    endTime: '1741132800000'
    output: vacation

Create a filter that archives newsletters

- GoogleMail.createFilter:
    criteria:
      from: newsletter@example.com
    filterAction:
      addLabelIds:
        - Label_1
      removeLabelIds:
        - INBOX
    output: filter
In App mode, the filter.action body field is exposed as filterAction to avoid colliding with the entity-level action selector used by the MCP tool. The connector maps it back to action before sending the request to Gmail.

Error Handling

HTTP StatusErrorSolution
401Unauthorized / token expiredThe OAuth token was revoked or expired. Re-run the connect flow for that user. The connector auto-refreshes when a refresh token is present
403ForbiddenCheck the OAuth scopes (https://mail.google.com/ for full mailbox access) and verify the Gmail API is enabled on the Google Cloud project
404Not FoundVerify message / thread / label IDs. Gmail IDs are sensitive — copy them straight from a list response
429Rate Limited / Quota exceededGmail enforces per-user and per-project quotas. Back off and retry with exponential delay
500Server errorTransient. Retry once with a small delay

Common Issues

“Not configured” — The app instance has no OAuth client. Fill in OAuth2 Client ID and OAuth2 Client Secret from the Google Cloud Console. “Invalid API key” (MCP) — The mcp-api-key header does not match the central app secret. Reinstall the app instance to regenerate a signed key. “Credentials lookup failed” — The MCP endpoint could not reach the getConfig webhook of the installed app. Verify that the app instance is still installed in the expected workspace. redirect_uri_mismatch at the Google consent screen — The redirect URI registered in your Google OAuth client does not match the one the connector sends. Copy the value of OAuth Callback URL from the app instance configuration and paste it verbatim into the Authorized redirect URIs list of your OAuth client in the Google Cloud Console. Gmail API has not been used in project ... or it is disabled — Enable the Gmail API at console.cloud.google.com/apis/library/gmail.googleapis.com for the project that owns your OAuth client. Propagation takes up to a minute. PERMISSION_DENIED: Feature not enabled (S/MIME tools) — The smimeInfo endpoints require a Google Workspace edition with S/MIME enabled at the admin level. They will systematically fail on personal @gmail.com accounts. PERMISSION_DENIED: Access restricted to service accounts that have been delegated domain-wide authority (delegates) — The delegates endpoints require Google Workspace domain-wide delegation and are not available to standard user-delegated OAuth tokens. Response auto-compacted to 50 KB — Expected behaviour, not an error. The connector detected a payload too large for safe LLM consumption and returned a structured summary plus recovery hints (e.g. re-call with format: metadata, lower maxResults, fetch attachments separately). Raise Max Tool Payload (KB) in the app configuration when targeting LLMs with very large context windows.

External Resources

Gmail API Reference

Official Gmail REST API v1 reference

Tool Agents

Plug MCP servers into AI Knowledge agents