Gemini Conversations

The Gemini Conversations integration imports Gemini app conversations from a Google Workspace organization through Google Vault. Each conversation appears in Agent Sessions for security review, with the prompts, the responses, the model Google reports, and timestamps.

Google Vault is the administrative export surface for Gemini app conversations, so the import runs in batches, not in real time. A conversation appears after its UTC day ends and Vault finishes the export. The import covers text prompts and responses only. It doesn’t import attachments or token and cost usage.

Access requirements

Viewing connection status on the AI Integrations page requires the org:read scope. Connecting, configuring, or deleting the integration requires the org:admin scope, held by the default Admin role.

Setup also needs these Google roles:

• A Google Cloud user who can enable APIs and create service accounts and keys in one project.
• A Google Workspace super administrator to authorize domain-wide delegation and assign admin roles.

Prepare Google Vault

Vault can only export conversations it still holds. Before connecting, set a Gemini retention rule in Google Vault for the users whose conversations should be imported. Without a rule, conversations that users delete, or that the Gemini conversation history setting removes, may be gone before an export runs. For retention rules, see Retain Gemini app messages with Vault in the Google Vault help.

Speakeasy creates its own Vault matter, named “Speakeasy Gemini import”, the first time the configuration is saved. If an open matter with that name already exists, Speakeasy reuses it instead. Closing or deleting the matter stops the import until the matter is open again.

Create the service account

In the Google Cloud console, select or create a project for the integration, then:

• Enable the Google Vault API and the Admin SDK API in the project.
• Create a service account.
• Create a JSON key for the service account and download it. The key grants access to Vault exports, so store it like a password. If an organization policy blocks service account key creation, a Google Cloud administrator must allow it for this project.
• Copy the service account’s client ID, shown as Unique ID on its details page.

Authorize domain-wide delegation

The service account reads Vault and the organizational unit list by acting as a Workspace admin, which requires domain-wide delegation. A super administrator authorizes it in the Google Admin console:

• Go to Security > Access and data control > API controls > Manage Domain Wide Delegation and click Add new.
• Enter the service account’s client ID.
• Enter these OAuth scopes:

https://www.googleapis.com/auth/ediscovery,https://www.googleapis.com/auth/devstorage.read_only,https://www.googleapis.com/auth/admin.directory.orgunit.readonly

The ediscovery scope manages the Vault matter and its exports, devstorage.read_only downloads finished export files, and admin.directory.orgunit.readonly lists organizational units during setup. Google can take up to 24 hours to apply delegation changes. For details, see Control API access with domain-wide delegation in the Google Workspace Admin Help.

Choose a delegated admin

The service account acts as one Workspace user, the delegated admin. Use a dedicated account with only these privileges:

• The Vault privileges Manage Matters, Manage Searches, and Manage Exports. See Set up Vault privileges.
• Permission to read organizational units, through an admin role with the Organizational Units > Read privilege. See Administrator privilege definitions.

The delegated admin owns the matter Speakeasy creates.

Connect it in the dashboard

Open Organization settings > Settings > AI Integrations, find Gemini Conversations, and click Configure. Setup takes two saves.

For the first save, enter:

• Service account JSON key: the full contents of the downloaded key file. The field is masked and cleared when the panel closes.
• Delegated admin email: the delegated admin’s email address, for example vault-export@example.com.

Click Save. Speakeasy checks the key and the delegated admin with Google and finds or creates the Vault matter. If Google refuses a step, the save fails with a message that names what to fix. See Troubleshooting.

For the second save, choose a unit from Organizational unit to export and click Save. Choose Entire organization to cover every user. Vault requires Gemini exports to be scoped to an organizational unit, so Entire organization exports the root unit, which includes every unit below it. Syncing starts once a unit is saved.

How the import works

The Conversation messages stream polls hourly. Each poll starts or resumes one Vault export that covers one completed UTC day:

• The first sync starts 30 days before the connection was created and works forward one day at a time.
• Each export also covers the 48 hours before its day, to pick up conversations that Vault indexed late. Once the import catches up, each poll rechecks the two most recent completed UTC days. Conversations that are already imported aren’t imported again.
• If an export expires, fails, or finishes only partly, the integration creates a new export for the same day instead of skipping it.

The stream can be paused and resumed from the connection’s detail row.

Change the configuration

• Choosing a different organizational unit or pasting a new key restarts the import from the beginning of the backfill window. Conversations already imported aren’t duplicated.
• Changing the delegated admin keeps the existing matter. The new delegated admin must be able to open it, so share the matter with them in Vault first.
• Saving the configuration again resumes a stream that paused itself after repeated failures.

Troubleshooting

Errors during setup appear when saving:

• Google rejected the service account credentials: check that the key is current, that the client ID is authorized with all three scopes, and that the delegated admin email is correct. Delegation changes can take time to apply.
• Google refused a directory token: add the https://www.googleapis.com/auth/admin.directory.orgunit.readonly scope to the domain-wide delegation.
• Google denied the organizational unit list: enable the Admin SDK API in the service account’s Google Cloud project, and give the delegated admin the Organizational Units > Read privilege.
• Google Vault denied access: give the delegated admin the Manage Matters, Manage Searches, and Manage Exports privileges and access to the matter.
• The Google Vault matter is not open: reopen the “Speakeasy Gemini import” matter in Vault.

Errors during a scheduled sync appear on the stream’s status. After three consecutive rejections, the stream pauses itself instead of retrying a configuration that Google refuses. Fix the cause, then save the configuration again to resume it.