Use cases → Documents and Drive
Indexing contract files in Drive with domain-wide delegation
How to reliably index contract files across Google Drive using domain-wide delegation, and what breaks when Shared Drives and impersonation are misunderstood.
| Who it is for | Platform engineers automating contract search or compliance across multiple Drive accounts and Shared Drives. |
|---|---|
| APIs | Drive API |
| Typical scopes | drive, admin.directory.user.readonly |
The problem
Legal and compliance teams often need a complete inventory of contract files scattered across user Drives and Shared Drives. Manual audits are slow and error-prone. Automating discovery with domain-wide delegation seems straightforward, but Drive’s sharing and membership model introduces subtle blind spots that lead to missed files and incomplete results.
How it works
- Identify all users and Shared Drives likely to contain contract files using the Admin SDK and Drive API.
- For each Shared Drive, ensure the impersonated user is a member; add them if necessary.
- Use the Drive API files.list endpoint with supportsAllDrives=true and includeItemsFromAllDrives=true, and ensure the impersonated user is a member of all relevant Shared Drives.
- Paginate through results to handle large result sets, and apply filters to narrow to contract files (e.g., by name, MIME type, or folder).
- Respect Drive API rate limits and implement retry logic for quota errors or propagation delays.
What changes
The automated index covers both user Drives and Shared Drives, providing legal and compliance teams with a near-complete picture of all contract files present in the organisation. Gaps caused by Drive membership or sharing edge cases are explicitly addressed.
Watch it explained
“Create Google API Key (2024) || Google Cloud Platform *NEW*” — Code & Code on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.
Questions people ask
How do I ensure all contracts are indexed?
Impersonate a user who is a member of every Shared Drive containing contracts—domain-wide delegation alone does not grant access to Shared Drives unless the user is a member. Review Drive sharing settings and membership lists.
Why do some contracts not appear in my results even with domain-wide delegation?
Drive API only returns files the impersonated user can see. If your service account impersonates a user who lacks access (membership or sharing), those files are omitted, with no error or warning.
Is it enough to add the service account directly to Shared Drives?
No, you must impersonate a real user who is a member of each Shared Drive. Service accounts themselves cannot be direct Shared Drive members; they must act as users.
Want this built?
This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.
Talk to us Or read the setup guideRelated use cases
Create a client folder structure the moment a deal closes
Provision a consistent Drive folder tree, seeded with templates and shared with the right people, automatically.
Generate documents from a template and real data
Produce agreements, letters and reports from a Docs template with fields filled from your systems.
Sort incoming files into the right place automatically
Watch a drop folder, work out what each file is, and file it where it belongs with a consistent name.