Code Samples for the Chrome Management Security Insights API

See Chrome Management Security Insights API for information about API features.

All the requests shown below use the following variables:

  • $TOKEN - OAuth 2 token
  • $CUSTOMER - ID of the customer or literal my_customer

Check the enablement status for insights for your domain

To check the enablement status for insights for your domain, use the checkEnablementStatus method.

Request

  curl -X GET \
  -H "Authorization: Bearer $TOKEN" \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:checkEnablementStatus"

Response

{
  "insightsState": "INSIGHTS_ENABLED"
}

Enable insights for your domain

To enable insights for your domain, use the enable method. You can optionally configure chrome connectors for a specific set of OUs by providing targetOus. If targetOus is not set then chrome connectors are configured at the root OU.

Request

  curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "targetOus": [
      "/corp/sales",
      "/eng"
    ]
  }' \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:enable"

Response

{
  "insightsState": "INSIGHTS_ENABLED"
}

Disable insights for your domain

To disable insights for your domain, use the disable method.

Request

  curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}' \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:disable"

Response

{
  "insightsState": "INSIGHTS_DISABLED"
}

Query high-level content transfer summaries for your domain

To retrieve high-level summaries of content transfers, use the queryContentTransfers method.

Request

  curl -G \
  -H "Authorization: Bearer $TOKEN" \
  --data-urlencode "filter=event_time >= \"2026-05-01T00:00:00Z\" AND event_time <= \"2026-05-02T00:00:00Z\"" \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:queryContentTransfers"

Response

{
  "summaries": [
    {
      "metric": "CONTENT_TRANSFERS_METRIC_TOTAL_SENSITIVE_TRANSFERS",
      "count": "918"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_TOTAL_DOWNLOADS",
      "count": "1537"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_TOTAL_UPLOADS",
      "count": "1532"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_SENSITIVE_UPLOADS",
      "count": "306"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_TOTAL_TRANSFERS",
      "count": "4596"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_SENSITIVE_PRINTS",
      "count": "305"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_SENSITIVE_DOWNLOADS",
      "count": "307"
    },
    {
      "metric": "CONTENT_TRANSFERS_METRIC_TOTAL_PRINTS",
      "count": "1527"
    }
  ]
}

Query content transfer summaries with breakdowns

To query content transfers with breakdowns by dimension (e.g., breakdown by USER), use the queryContentTransfersBreakdowns method.

Request

  curl -G \
  -H "Authorization: Bearer $TOKEN" \
  --data-urlencode "breakdown=USER" \
  --data-urlencode "metric=CONTENT_TRANSFERS_METRIC_TOTAL_TRANSFERS" \
  --data-urlencode "fixedTimeRange=FIXED_TIME_RANGE_FOUR_WEEKS" \
  --data-urlencode "filter=user = \"user1\" AND event_time <= \"2026-05-01T00:00:00Z\"" \
  --data-urlencode "pageSize=5" \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:queryContentTransfersBreakdowns"

Response

{
  "contentTransfersBreakdowns": [
    {
      "user": "user1",
      "summary": {
        "metric": "CONTENT_TRANSFERS_METRIC_TOTAL_TRANSFERS",
        "count": "20"
      }
    }
  ]
}

Query high-level URL visit summaries for your domain

To retrieve high-level summaries of suspicious URL visits, use the queryUrlVisits method.

Request

  curl -G \
  -H "Authorization: Bearer $TOKEN" \
  --data-urlencode "filter=event_time >= \"2026-05-01T00:00:00Z\" AND event_time <= \"2026-05-02T00:00:00Z\"" \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:queryUrlVisits"

Response

{
  "summaries": [
    {
      "metric": "URL_VISITS_METRIC_HIGH_RISK_URL_VISITS",
      "count": "286"
    },
    {
      "metric": "URL_VISITS_METRIC_LOW_RISK_URL_VISITS",
      "count": "287"
    },
    {
      "metric": "URL_VISITS_METRIC_TOTAL_SUSPICIOUS_URL_VISITS",
      "count": "859"
    },
    {
      "metric": "URL_VISITS_METRIC_MEDIUM_RISK_URL_VISITS",
      "count": "286"
    }
  ]
}

Query URL visit summaries with breakdowns

To query URL visits with breakdowns by dimension (e.g., breakdown by EVENT_DOMAIN), use the queryUrlVisitsBreakdowns method.

Request

  curl -G \
  -H "Authorization: Bearer $TOKEN" \
  --data-urlencode "breakdown=EVENT_DOMAIN" \
  --data-urlencode "metric=URL_VISITS_METRIC_TOTAL_SUSPICIOUS_URL_VISITS" \
  --data-urlencode "fixedTimeRange=FIXED_TIME_RANGE_ONE_WEEK" \
  --data-urlencode "filter=event_domain = \"suspicious-domain.com\" AND event_time <= \"2026-05-01T00:00:00Z\"" \
  --data-urlencode "pageSize=5" \
  "https://chromemanagement.googleapis.com/v1/customers/$CUSTOMER/enterprise/securityInsights:queryUrlVisitsBreakdowns"

Response

{
  "urlVisitsBreakdowns": [
    {
      "eventDomain": "suspicious-domain.com",
      "summary": {
        "metric": "URL_VISITS_METRIC_TOTAL_SUSPICIOUS_URL_VISITS",
        "count": "132"
      }
    }
  ]
}