# Gemini Conversations The Gemini Conversations integration imports Gemini app conversations from a Google Workspace organization through Google Vault. Each conversation appears in [Agent Sessions](/docs/ai-control-plane/observe/agent-sessions) for security review, with the prompts, the responses, the model Google reports, and timestamps. > Google Vault is the administrative export surface for Gemini app > conversations, so the import runs in batches, not in real time. A conversation > appears after its UTC day ends and Vault finishes the export. The import > covers text prompts and responses only. It doesn't import attachments or token > and cost usage. ## Access requirements > Viewing connection status on the AI Integrations page requires the `org:read` > scope. Connecting, configuring, or deleting the integration requires the > `org:admin` scope, held by the default [Admin > role](/docs/ai-control-plane/org-admin/roles-and-permissions). Setup also needs these Google roles: - A Google Cloud user who can enable APIs and create service accounts and keys in one project. - A Google Workspace super administrator to authorize domain-wide delegation and assign admin roles. ## Prepare Google Vault Vault can only export conversations it still holds. Before connecting, set a Gemini retention rule in [Google Vault](https://vault.google.com) for the users whose conversations should be imported. Without a rule, conversations that users delete, or that the Gemini conversation history setting removes, may be gone before an export runs. For retention rules, see [Retain Gemini app messages with Vault](https://knowledge.workspace.google.com/vault/retention/retain-gemini-app-messages-with-vault) in the Google Vault help. Speakeasy creates its own Vault matter, named "Speakeasy Gemini import", the first time the configuration is saved. If an open matter with that name already exists, Speakeasy reuses it instead. Closing or deleting the matter stops the import until the matter is open again. ## Create the service account In the [Google Cloud console](https://console.cloud.google.com), select or create a project for the integration, then: - Enable the **Google Vault API** and the **Admin SDK API** in the project. - Create a service account. - Create a JSON key for the service account and download it. The key grants access to Vault exports, so store it like a password. If an organization policy blocks service account key creation, a Google Cloud administrator must allow it for this project. - Copy the service account's client ID, shown as **Unique ID** on its details page. ## Authorize domain-wide delegation The service account reads Vault and the organizational unit list by acting as a Workspace admin, which requires domain-wide delegation. A super administrator authorizes it in the [Google Admin console](https://admin.google.com): - Go to **Security > Access and data control > API controls > Manage Domain Wide Delegation** and click **Add new**. - Enter the service account's client ID. - Enter these OAuth scopes: ```text https://www.googleapis.com/auth/ediscovery,https://www.googleapis.com/auth/devstorage.read_only,https://www.googleapis.com/auth/admin.directory.orgunit.readonly ``` The `ediscovery` scope manages the Vault matter and its exports, `devstorage.read_only` downloads finished export files, and `admin.directory.orgunit.readonly` lists organizational units during setup. Google can take up to 24 hours to apply delegation changes. For details, see [Control API access with domain-wide delegation](https://support.google.com/a/answer/162106) in the Google Workspace Admin Help. ## Choose a delegated admin The service account acts as one Workspace user, the delegated admin. Use a dedicated account with only these privileges: - The Vault privileges **Manage Matters**, **Manage Searches**, and **Manage Exports**. See [Set up Vault privileges](https://support.google.com/vault/answer/2799699). - Permission to read organizational units, through an admin role with the **Organizational Units > Read** privilege. See [Administrator privilege definitions](https://support.google.com/a/answer/1219251). The delegated admin owns the matter Speakeasy creates. ## Connect it in the dashboard Open [**Organization settings > Settings > AI Integrations**](https://ai.speakeasy.com/@self/ai-integrations), find **Gemini Conversations**, and click **Configure**. Setup takes two saves. For the first save, enter: - **Service account JSON key**: the full contents of the downloaded key file. The field is masked and cleared when the panel closes. - **Delegated admin email**: the delegated admin's email address, for example `vault-export@example.com`. Click **Save**. Speakeasy checks the key and the delegated admin with Google and finds or creates the Vault matter. If Google refuses a step, the save fails with a message that names what to fix. See [Troubleshooting](#troubleshooting). For the second save, choose a unit from **Organizational unit to export** and click **Save**. Choose **Entire organization** to cover every user. Vault requires Gemini exports to be scoped to an organizational unit, so **Entire organization** exports the root unit, which includes every unit below it. Syncing starts once a unit is saved. ## How the import works The **Conversation messages** stream polls hourly. Each poll starts or resumes one Vault export that covers one completed UTC day: - The first sync starts 30 days before the connection was created and works forward one day at a time. - Each export also covers the 48 hours before its day, to pick up conversations that Vault indexed late. Once the import catches up, each poll rechecks the two most recent completed UTC days. Conversations that are already imported aren't imported again. - If an export expires, fails, or finishes only partly, the integration creates a new export for the same day instead of skipping it. The stream can be paused and resumed from the connection's detail row. ## Change the configuration - Choosing a different organizational unit or pasting a new key restarts the import from the beginning of the backfill window. Conversations already imported aren't duplicated. - Changing the delegated admin keeps the existing matter. The new delegated admin must be able to open it, so share the matter with them in Vault first. - Saving the configuration again resumes a stream that paused itself after repeated failures. ## Troubleshooting Errors during setup appear when saving: - **Google rejected the service account credentials**: check that the key is current, that the client ID is authorized with all three scopes, and that the delegated admin email is correct. Delegation changes can take time to apply. - **Google refused a directory token**: add the `https://www.googleapis.com/auth/admin.directory.orgunit.readonly` scope to the domain-wide delegation. - **Google denied the organizational unit list**: enable the **Admin SDK API** in the service account's Google Cloud project, and give the delegated admin the **Organizational Units > Read** privilege. - **Google Vault denied access**: give the delegated admin the **Manage Matters**, **Manage Searches**, and **Manage Exports** privileges and access to the matter. - **The Google Vault matter is not open**: reopen the "Speakeasy Gemini import" matter in Vault. Errors during a scheduled sync appear on the stream's status. After three consecutive rejections, the stream pauses itself instead of retrying a configuration that Google refuses. Fix the cause, then save the configuration again to resume it. --- Index of every Speakeasy page for agents: [llms.txt](https://www.speakeasy.com/llms.txt). AI control plane and MCP gateway content in one file: [llms-full.txt](https://www.speakeasy.com/llms-full.txt). Any page is available as markdown by appending `.md` to its URL or by requesting it with `Accept: text/markdown`.