Skip to main content

Google Workspace

Runs nc-export.py against two CSV exports from the Admin Console — one required, one optional. Nothing about your Workspace directory is sent anywhere until you choose to upload the file this produces.

Read the privacy statement first if you have not already.

Step 0 — get the script​

Download nc-export.py from the downloads page and verify its checksum before you run it. The command below assumes you run it from the same directory you downloaded it into.

Before you start​

  • Python 3 — no packages to install; the script is standard-library only.
  • Admin Console access, to pull the audit export below — specifically, the Reports admin privilege (or Super Admin), which is what the Admin Console requires to view and export Reports > OAuth Token Audit Activity.

Export from the Admin Console​

  1. OAuth Token Audit Activity (required). In the Admin Console, go to Reports > OAuth Token Audit Activity, filter to the period you want, and export the results to CSV. This log is what the report is built from, and it is worth knowing its shape going in: it has a retention window — commonly around six months — so an app authorized outside that window and never re-authorized since will not appear (see Google's data-retention documentation). The report reflects what the audit log still has, not the tenant's complete authorization history.
  2. Users (optional). A Users export gives the script an accurate userCountTotal for the header — without it, that field is left null rather than guessed. See the export format page for what that field means.

Run it​

python3 nc-export.py google \
  --audit-csv oauth-token-audit.csv \
  --users-csv users.csv \
  --out-dir ./out

--users-csv is optional — omit it if you skipped the Users export. --audit-csv and --out-dir are required. Two other flags are available if you need them: --salt-file (use a fixed salt for reproducible pseudonym output) and --no-pseudonymize (write raw email addresses instead of pseudonyms — only if your organization has decided that is acceptable to share).

What you'll see​

Skipped rows: 0
Nothing has been sent anywhere. Review discover-export.ndjson, then upload it in the Discover app.

Skipped rows is always printed, even when it is 0. A CSV row with a missing or blank required value (actor email, client ID, app name) is skipped with a warning rather than silently mangled or dropped.

If something goes wrong​

The script fails loudly rather than guessing. A few messages you might see, and what they mean:

  • audit CSV '<path>' is missing required column(s): ... — the export doesn't have the columns the script expects. Re-export from Reports > OAuth Token Audit Activity rather than a filtered or re-saved copy.
  • warning: 0 grants were found in the source data -- this may indicate a permission or consent problem, not an empty tenant — printed to the terminal, not fatal. Check the Reports admin privilege above before assuming the tenant has no grants.
  • warning: 0 users were found in the source data -- this may indicate a permission or consent problem, not an empty tenant — the same idea, printed only if you supplied --users-csv.

After it finishes​

  1. Open ./out/discover-export.ndjson and read it — see the export format page for the exact field-by-field shape.
  2. Leave ./out/mapping.csv and ./out/salt.txt on your machine. See the privacy statement for what they're for.
  3. Upload discover-export.ndjson in the Discover app.
Screenshot pending

The upload flow is live in Discover; a screenshot of this step is still being prepared and will be added here.

Next​