As a Google Workspace super admin, you can give Jatheon access to your Google Vault data, so we can export it and migrate it to Jatheon Cloud. You'll create a Google Cloud project with the Vault API, an OAuth client and a service account, and then authorize the service account with domain-wide delegation.

Create a Google Cloud project

1. Sign in to the Google Cloud console with your Google Workspace super admin account.
2. Click the project picker in the top bar and select New project.
3. Enter a Project name, for example API1.
4. Click Create.
5. Make sure the new project is selected in the project picker. All of the following steps must be done in this project.

Create an OAuth client

1. Go to APIs & Services > Google Auth Platform. If the Google Auth Platform isn't configured yet, click Get started:
   • Enter an App name and a User support email, then click Next.
   • Under Audience, select Internal, then click Next.
   • Enter a Contact Information email address, then click Next.
   • Agree to the Google API Services User Data Policy, click Continue and then Create.
2. Open Clients and click Create client.
3. Under Application type, select Desktop app.
4. Enter a Name, for example Vault Desktop Access, and click Create.
5. Click Download JSON to download the credentials file.
6. Rename the file so it's easy to identify, for example companyname.credentials.json.

Enable the Google Vault API

1. Open the Google Vault API page in the API Library.
2. Make sure your project is selected.
3. Click Enable.

Create a service account and key

1. Open the Service accounts page and make sure your project is selected.
2. Click Create service account.
3. Enter a Service account name and, optionally, a description.
4. Click Create and continue.
5. Under Role, select Owner.
6. Click Done.
7. In the service accounts list, copy the account's OAuth 2 Client ID (also shown as Unique ID in its details). You'll need it for domain-wide delegation.
8. Click the service account's email address and open the Keys tab.
9. Click Add key > Create new key.
10. Select JSON and click Create. The key file downloads automatically. Store it securely, because you can't download it again.

Please note that Google blocks service account key creation by default in organizations created on or after May 3, 2024. If you can't create the key, ask a Google Cloud organization admin to allow it for this project (organization policy iam.disableServiceAccountKeyCreation). To create keys, you need the Service Account Key Admin role.

Set up domain-wide delegation

1. Sign in to the Google Admin console as a super admin.
2. Go to Menu > Security > Access and data control > API controls.
3. Click Manage Domain Wide Delegation.
4. Click Add new.
5. In Client ID, paste the service account's client ID you copied earlier.
6. In OAuth scopes, add these scopes, one per line:
   • https://www.googleapis.com/auth/ediscovery
   • https://www.googleapis.com/auth/devstorage.full_control
7. Click Authorize.

Please note that changes can take up to 24 hours to apply, but usually take effect sooner. If multi-party approval is turned on in your organization, another super admin has to approve the change.

Send the details to Jatheon

The service account can't access Vault data on its own. It acts on behalf of a user in your organization. Send your Jatheon contact:

• the credentials file of the OAuth client
• the key file of the service account
• the email address of a Vault user we'll act on behalf of during the migration

That user needs the Manage Exports privilege in Google Vault, and the matters you want to migrate must be shared with them.

Please note that we can start the migration only once domain-wide delegation has taken effect, which can take up to 24 hours after you click Authorize. You can create and send the files in any order.