Google Cloud Storage

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	no extra properties
required.bucket	string	Yes	Google Cloud Storage bucket name	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	No	Optional inline service account credentials JSON. Leave empty to use ADC/workload identity.	—	no extra properties
masked.gcp_credentials_json	string	No	Google service account credentials JSON as inline string	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	—	—	no extra properties
optional.connection.gcp_credentials_file	string	No	Path to Google service account JSON credentials file	—	—
optional.connection.max_keys_per_page	integer	No	Maximum objects requested per list page	200	min 1, max 1000
optional.connection.max_object_bytes	integer	No	Maximum bytes downloaded per object for MIME detection and text extraction	5242880	min 1024, max 52428800
optional.connection.project_id	string	No	Optional GCP project ID override for auth context and bucket listing	—	—
optional.connection.request_timeout_seconds	number	No	Network timeout in seconds for list/download operations	30	min 1, max 300
optional.scope	object	No	Object scope and filtering controls.	—	no extra properties
optional.scope.exclude_extensions	array	No	Optional extension denylist	—	—
optional.scope.exclude_extensions[]	string	No	—	—	—
optional.scope.include_content_preview	boolean	No	Download object bytes to infer MIME and extract detector-ready text previews	true	—
optional.scope.include_empty_objects	boolean	No	Include zero-byte objects in extraction results	false	—
optional.scope.include_extensions	array	No	Optional extension allowlist (for example, .pdf, .csv, .parquet)	—	—
optional.scope.include_extensions[]	string	No	—	—	—
optional.scope.include_object_metadata	boolean	No	Attach provider metadata (etag, size, content-type hints, timestamps) to asset checksums	true	—
optional.scope.prefix	string	No	Object key prefix filter (for example, exports/2026/)	—	—

Extracted Metadata

File

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
page_count	integer	No	Number of pages (pdf)
paragraph_count	integer	No	Number of paragraphs (docx)
table_count	integer	No	Number of tables (docx)
row_count	integer	No	Number of data rows
columns	object[]	No	Columns as {name, type} objects (type may be empty for csv/xlsx)
encoding	string	No	Detected character encoding
json_root_type	string	No	Root JSON type: object, array, or scalar
top_level_keys	integer	No	Number of top-level keys when the root is an object
array_length	integer	No	Length when the root is an array
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
etag	string	No	Object entity tag
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Image

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
provider	string	No	Storage provider label
object_key	string	No	Object key/path
etag	string	No	Object entity tag
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Audio

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Video

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Archive

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
provider	string	Yes	Storage provider label
object_key	string	Yes	Object key/path
etag	string	No	Object entity tag
source_hash	string	No	Hash of the parent asset (embedded images and archive members only)
location	string	No	Location within the parent (embedded image location or archive member path)

Examples

GCS bucket scan with ADC

Scan all objects in a GCS bucket using Application Default Credentials

Config Payload

{
  "type": "GOOGLE_CLOUD_STORAGE",
  "required": {
    "bucket": "your-bucket-name"
  },
  "masked": {},
  "optional": {
    "connection": {
      "project_id": "your-gcp-project-id"
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  }
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "26 1 * * *",
  "timezone": "UTC"
}

GCS export folder PII scan

Scan objects under a prefix with service account credentials and run PII detection

Config Payload

{
  "type": "GOOGLE_CLOUD_STORAGE",
  "required": {
    "bucket": "your-bucket-name"
  },
  "masked": {
    "gcp_credentials_json": "{\"type\":\"service_account\",\"project_id\":\"your-project\",...}"
  },
  "optional": {
    "connection": {
      "project_id": "your-gcp-project-id"
    },
    "scope": {
      "prefix": "exports/",
      "include_content_preview": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "45 2 * * *",
  "timezone": "UTC"
}