Google Cloud Storage

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	no extra properties
required.bucket	string	Yes	Google Cloud Storage bucket name	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	No	Optional inline service account credentials JSON. Leave empty to use ADC/workload identity.	—	no extra properties
masked.gcp_credentials_json	string	No	Google service account credentials JSON as inline string	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	—	—	no extra properties
optional.connection.gcp_credentials_file	string	No	Path to Google service account JSON credentials file	—	—
optional.connection.max_keys_per_page	integer	No	Maximum objects requested per list page	200	min 1, max 1000
optional.connection.max_object_bytes	integer	No	Maximum bytes downloaded per object for MIME detection and text extraction	5242880	min 1024, max 52428800
optional.connection.project_id	string	No	Optional GCP project ID override for auth context and bucket listing	—	—
optional.connection.request_timeout_seconds	number	No	Network timeout in seconds for list/download operations	30	min 1, max 300
optional.scope	object	No	Object scope and filtering controls.	—	no extra properties
optional.scope.exclude_extensions	array	No	Optional extension denylist	—	—
optional.scope.exclude_extensions[]	string	No	—	—	—
optional.scope.include_content_preview	boolean	No	Download object bytes to infer MIME and extract detector-ready text previews	true	—
optional.scope.include_empty_objects	boolean	No	Include zero-byte objects in extraction results	false	—
optional.scope.include_extensions	array	No	Optional extension allowlist (for example, .pdf, .csv, .parquet)	—	—
optional.scope.include_extensions[]	string	No	—	—	—
optional.scope.include_object_metadata	boolean	No	Attach provider metadata (etag, size, content-type hints, timestamps) to asset checksums	true	—
optional.scope.prefix	string	No	Object key prefix filter (for example, exports/2026/)	—	—

Extracted Metadata

File

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
page_count	integer	No	Number of pages (pdf)
paragraph_count	integer	No	Number of paragraphs (docx)
table_count	integer	No	Number of tables (docx)
row_count	integer	No	Number of data rows
columns	object[]	No	Columns as {name, type} objects (type may be empty for csv/xlsx)
encoding	string	No	Detected character encoding
json_root_type	string	No	Root JSON type: object, array, or scalar
top_level_keys	integer	No	Number of top-level keys when the root is an object
array_length	integer	No	Length when the root is an array
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
etag	string	No	Object entity tag

Image

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
source_hash	string	Yes	Hash of the parent object asset
location	string	Yes	Location of the embedded image within the parent

Audio

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path

Video

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path

Examples

GCS bucket scan with ADC

Scan all objects in a GCS bucket using Application Default Credentials

Config Payload

{
  "type": "GOOGLE_CLOUD_STORAGE",
  "required": {
    "bucket": "your-bucket-name"
  },
  "masked": {},
  "optional": {
    "connection": {
      "project_id": "your-gcp-project-id"
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  }
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "26 1 * * *",
  "timezone": "UTC"
}

GCS export folder PII scan

Scan objects under a prefix with service account credentials and run PII detection

Config Payload

{
  "type": "GOOGLE_CLOUD_STORAGE",
  "required": {
    "bucket": "your-bucket-name"
  },
  "masked": {
    "gcp_credentials_json": "{\"type\":\"service_account\",\"project_id\":\"your-project\",...}"
  },
  "optional": {
    "connection": {
      "project_id": "your-gcp-project-id"
    },
    "scope": {
      "prefix": "exports/",
      "include_content_preview": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "45 2 * * *",
  "timezone": "UTC"
}