Required Scopes & Permissions

A consolidated reference of everything Helios requests. Use this for security review or to hand to whoever administers your identity provider.

Google Workspace

Interactive OAuth (admin sign-in)

Scope	Purpose
openid, email	Identify admin + domain
gmail.modify	Move/label mail
admin.directory.user.readonly	List users
admin.directory.group.readonly	Resolve groups

Domain-wide delegation (service account)

Service account Client ID: 114733393163502940734

Scope	Purpose
gmail.modify	Quarantine (move out of inbox)
gmail.settings.basic	Read/write inbox filters (posture)
admin.directory.user.readonly	Enumerate mailboxes
admin.directory.user.security	Per-user OAuth app tokens (posture)
gmail.settings.sharing (optional)	Auto-remove forwarding/delegate rules (exfil remediation)

Full comma-separated DWD list (without the optional sharing scope):

https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user.security

Microsoft 365

Delegated (mailbox protection)

openid · email · profile · offline_access · User.Read · User.Read.All · Mail.Read · Mail.ReadWrite · MailboxSettings.Read · Group.Read.All

Application (SaaS Security scanner)

User.Read.All · Group.Read.All · Sites.Read.All · Files.Read.All · ChannelMessage.Read.All · Directory.Read.All · Policy.Read.All · AuditLog.Read.All · AppCatalog.Read.All · TeamsAppInstallation.ReadForTeam.All · InformationProtectionPolicy.Read.All · IdentityRiskyUser.Read.All · IdentityRiskEvent.Read.All · SecurityEvents.Read.All

Note

All OAuth tokens are encrypted at rest with Fernet before being stored. Every query is scoped to your org_id — there is no cross-tenant access.

Redirect URIs

Provider	Redirect URI
Google	https://app.himaya.ai/api/onboarding/callback/google
Microsoft 365	https://app.himaya.ai/api/onboarding/callback/m365