Documentation Index
Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt
Use this file to discover all available pages before exploring further.
The Google Mail app provides read/write access to a user’s Gmail mailbox through the Gmail REST API v1. It can be used either as a Builder app (automations call Gmail instructions directly) or as a remote MCP server consumed by an AI agent. Each tenant configures its own Google OAuth Application; end-users sign in with their own Google account and tokens are stored per (user × tenant). The connector exposes 68 underlying operations, grouped into 13 entity tools covering messages, threads, drafts, labels, attachments, history, profile, settings, filters, forwarding addresses, send-as aliases, S/MIME and delegates.
Messages & Threads
List, search, read, send, label, trash, untrash and modify messages, threads and attachments
Mailbox Settings
Vacation responder, filters, forwarding, IMAP/POP, language and history streaming
Identities & Delegates
Send-as aliases, S/MIME certificates and account-wide delegates
Prerequisites
- A Google account with access to the mailbox you want to expose. For Google Workspace mailboxes, the workspace admin may need to allow third-party OAuth apps.
- A Google Cloud project with the Gmail API enabled at console.cloud.google.com/apis/library/gmail.googleapis.com.
- A Google OAuth 2.0 Client of type Web application, created at console.cloud.google.com/apis/credentials. The Authorized redirect URIs must contain the value shown in the
OAuth Callback URLfield of the installed app instance (auto-populated on install — copy it back into the Google Cloud Console after installation). - An OAuth consent screen configured in the Google Cloud project. While the app is in Testing state, add the end-user’s email to Test users. The full mailbox scope (
https://mail.google.com/) is classed restricted by Google and requires CASA verification when the consent screen moves to Production. - Base URL (default:
https://gmail.googleapis.com)
- Usage as App
- Usage as MCP
Installation
- Go to Apps in your workspace
- Search for Google Mail and install it
- Open the app instance configuration and fill in the required fields
Configuration
| Field | Description |
|---|---|
| Gmail API Base URL | Base URL of the Gmail API (default https://gmail.googleapis.com) |
| API Token (fallback) | Optional static OAuth access token used as a shared fallback for all users of this tenant. Stored as a workspace secret. Most deployments leave this empty and rely on per-user OAuth instead. |
| OAuth2 Client ID | Google OAuth Application Client ID. Create an OAuth client of type Web application in the Google Cloud Console |
| OAuth2 Client Secret | Google OAuth Client Secret, stored as a workspace secret |
| OAuth Callback URL | Auto-populated on install — paste this value into the Authorized redirect URIs list of your Google OAuth client |
| OAuth Authorize URL | Default https://accounts.google.com/o/oauth2/v2/auth |
| OAuth Token URL | Default https://oauth2.googleapis.com/token |
| OAuth Revoke URL | Default https://oauth2.googleapis.com/revoke |
| OAuth Scopes | Space-separated Google API scopes. Default https://mail.google.com/ (full mailbox access). Other common values: gmail.readonly, gmail.send, gmail.modify, gmail.labels, gmail.settings.basic |
| Refresh Token TTL (seconds) | Default 15552000 (180 days, Google’s max) |
| Max Tool Payload (KB) | Threshold above which MCP responses are auto-compacted into a summary + recovery hints to avoid overflowing the LLM context. Default 50. Raise it (for example 200) when targeting LLMs with 1M-token windows |
| MCP Endpoint | Auto-populated on install — URL of the MCP endpoint for this instance |
| MCP API Key | Auto-populated on install — signed key used in the mcp-api-key header. Do not modify |
MCP Endpoint, MCP API Key and OAuth Callback URL are generated automatically by the onInstall flow. The OAuth credentials below (OAuth2 Client ID, OAuth2 Client Secret) must be filled in manually after creating the OAuth client in the Google Cloud Console.Authorize end-users
Once the app instance is configured, each end-user authorizes their own Google account through a browser-based consent screen:Trigger the connect flow
From an MCP client (Agent Creator capability or any tool client), call any data tool. If no OAuth session exists for the current user × tenant, the MCP server returns a
connector_auth_required payload with a connect_url. Alternatively, call the connect tool explicitly to receive the same payload.Open the connect URL
Open the returned URL in a browser tab where the user is already authenticated to Prisme.ai. The platform redirects to the Google OAuth consent screen.
Grant access
The user reviews the requested scopes (default
https://mail.google.com/) and clicks Allow. Google redirects back to the platform’s oauthCallback webhook.Available Instructions
Every instruction resolves credentials from the workspace configuration. TheuserId argument defaults to me (the authenticated end-user) — pass an explicit email address only when calling on behalf of a delegated account. Most list operations accept maxResults (default 100) and pageToken for pagination, plus a Gmail-style q query string for filtering.Messages
| Instruction | Arguments |
|---|---|
listMessages | userId, maxResults, pageToken, q, labelIds, includeSpamTrash |
getMessage | userId, id*, format (minimal/metadata/full/raw), metadataHeaders |
sendMessage | userId, raw*, threadId, labelIds, payload |
insertMessage | userId, raw*, threadId, labelIds, payload, internalDateSource, deleted |
importMessage | userId, raw*, threadId, labelIds, payload, internalDateSource, neverMarkSpam, processForCalendar, deleted |
deleteMessage | userId, id* |
trashMessage | userId, id* |
untrashMessage | userId, id* |
modifyMessage | userId, id*, addLabelIds, removeLabelIds |
batchModifyMessages | userId, ids*, addLabelIds, removeLabelIds |
batchDeleteMessages | userId, ids* |
Threads
| Instruction | Arguments |
|---|---|
listThreads | userId, maxResults, pageToken, q, labelIds, includeSpamTrash |
getThread | userId, id*, format, metadataHeaders |
deleteThread | userId, id* |
trashThread | userId, id* |
untrashThread | userId, id* |
modifyThread | userId, id*, addLabelIds, removeLabelIds |
Attachments
| Instruction | Arguments |
|---|---|
getAttachment | userId, messageId, id |
Drafts
| Instruction | Arguments |
|---|---|
listDrafts | userId, maxResults, pageToken, q, includeSpamTrash |
getDraft | userId, id*, format |
createDraft | userId, message* |
updateDraft | userId, id, message |
deleteDraft | userId, id* |
sendDraft | userId, id*, message |
Labels
| Instruction | Arguments |
|---|---|
listLabels | userId |
getLabel | userId, id* |
createLabel | userId, name*, labelListVisibility, messageListVisibility, color, type |
updateLabel | userId, id*, name, labelListVisibility, messageListVisibility, color, type |
patchLabel | userId, id*, name, labelListVisibility, messageListVisibility, color, type |
deleteLabel | userId, id* |
History
| Instruction | Arguments |
|---|---|
listHistory | userId, startHistoryId*, maxResults, pageToken, labelId, historyTypes |
Profile & Push Notifications
| Instruction | Arguments |
|---|---|
getProfile | userId |
watchInbox | userId, topicName*, labelIds, labelFilterAction, labelFilterBehavior |
stopWatch | userId |
Settings
| Instruction | Arguments |
|---|---|
getAutoForwarding | userId |
updateAutoForwarding | userId, enabled, emailAddress, disposition |
getImap | userId |
updateImap | userId, enabled, autoExpunge, expungeBehavior, maxFolderSize |
getLanguage | userId |
updateLanguage | userId, displayLanguage* |
getPop | userId |
updatePop | userId, accessWindow, disposition |
getVacation | userId |
updateVacation | userId, enableAutoReply, responseSubject, responseBodyPlainText, responseBodyHtml, restrictToContacts, restrictToDomain, startTime, endTime |
Filters
| Instruction | Arguments |
|---|---|
listFilters | userId |
getFilter | userId, id* |
createFilter | userId, criteria, filterAction |
deleteFilter | userId, id* |
Forwarding Addresses
| Instruction | Arguments |
|---|---|
listForwardingAddresses | userId |
getForwardingAddress | userId, forwardingEmail* |
createForwardingAddress | userId, forwardingEmail* |
deleteForwardingAddress | userId, forwardingEmail* |
Send-As Aliases
| Instruction | Arguments |
|---|---|
listSendAs | userId |
getSendAs | userId, sendAsEmail* |
createSendAs | userId, sendAsEmail*, displayName, replyToAddress, signature, isPrimary, treatAsAlias, smtpMsa |
updateSendAs | userId, sendAsEmail*, displayName, replyToAddress, signature, isPrimary, treatAsAlias, smtpMsa |
patchSendAs | userId, sendAsEmail*, displayName, replyToAddress, signature, isPrimary, treatAsAlias, smtpMsa |
deleteSendAs | userId, sendAsEmail* |
verifySendAs | userId, sendAsEmail* |
S/MIME
| Instruction | Arguments |
|---|---|
listSmimeInfo | userId, sendAsEmail* |
getSmimeInfo | userId, sendAsEmail, id |
insertSmimeInfo | userId, sendAsEmail, pkcs12, encryptedKeyPassword |
deleteSmimeInfo | userId, sendAsEmail, id |
setDefaultSmimeInfo | userId, sendAsEmail, id |
Delegates
| Instruction | Arguments |
|---|---|
listDelegates | userId |
getDelegate | userId, delegateEmail* |
createDelegate | userId, delegateEmail*, verificationStatus |
deleteDelegate | userId, delegateEmail* |
Arguments flagged with
* are required. The userId argument defaults to me — leave it empty unless you explicitly need to address a delegated mailbox.DSUL Examples
List the latest unread messages in the inbox
Send a plain-text email
The Gmail API requires the message as a base64url-encoded RFC 2822 string. Build the MIME body in Custom Code first, then pass it asraw.Apply a label to a thread
Enable an out-of-office responder
Create a filter that archives newsletters
In App mode, the
filter.action body field is exposed as filterAction to avoid colliding with the entity-level action selector used by the MCP tool. The connector maps it back to action before sending the request to Gmail.Error Handling
| HTTP Status | Error | Solution |
|---|---|---|
| 401 | Unauthorized / token expired | The OAuth token was revoked or expired. Re-run the connect flow for that user. The connector auto-refreshes when a refresh token is present |
| 403 | Forbidden | Check the OAuth scopes (https://mail.google.com/ for full mailbox access) and verify the Gmail API is enabled on the Google Cloud project |
| 404 | Not Found | Verify message / thread / label IDs. Gmail IDs are sensitive — copy them straight from a list response |
| 429 | Rate Limited / Quota exceeded | Gmail enforces per-user and per-project quotas. Back off and retry with exponential delay |
| 500 | Server error | Transient. Retry once with a small delay |
Common Issues
“Not configured” — The app instance has no OAuth client. Fill inOAuth2 Client ID and OAuth2 Client Secret from the Google Cloud Console.
“Invalid API key” (MCP) — The mcp-api-key header does not match the central app secret. Reinstall the app instance to regenerate a signed key.
“Credentials lookup failed” — The MCP endpoint could not reach the getConfig webhook of the installed app. Verify that the app instance is still installed in the expected workspace.
redirect_uri_mismatch at the Google consent screen — The redirect URI registered in your Google OAuth client does not match the one the connector sends. Copy the value of OAuth Callback URL from the app instance configuration and paste it verbatim into the Authorized redirect URIs list of your OAuth client in the Google Cloud Console.
Gmail API has not been used in project ... or it is disabled — Enable the Gmail API at console.cloud.google.com/apis/library/gmail.googleapis.com for the project that owns your OAuth client. Propagation takes up to a minute.
PERMISSION_DENIED: Feature not enabled (S/MIME tools) — The smimeInfo endpoints require a Google Workspace edition with S/MIME enabled at the admin level. They will systematically fail on personal @gmail.com accounts.
PERMISSION_DENIED: Access restricted to service accounts that have been delegated domain-wide authority (delegates) — The delegates endpoints require Google Workspace domain-wide delegation and are not available to standard user-delegated OAuth tokens.
Response auto-compacted to 50 KB — Expected behaviour, not an error. The connector detected a payload too large for safe LLM consumption and returned a structured summary plus recovery hints (e.g. re-call with format: metadata, lower maxResults, fetch attachments separately). Raise Max Tool Payload (KB) in the app configuration when targeting LLMs with very large context windows.
External Resources
Gmail API Reference
Official Gmail REST API v1 reference
Tool Agents
Plug MCP servers into AI Knowledge agents