canonical: https://jentic.com/apis/googleapis.com/keep # Google Keep API The Google Keep API gives Google Workspace administrators and security tools programmatic access to notes stored in user accounts so they can investigate and remediate findings raised by data loss prevention or insider risk software. It exposes operations to list, create, and delete notes, download attached media, and batch-manage permissions on a note. The API is restricted to enterprise contexts and is not available for consumer Keep accounts. ## For AI agents List, create, and delete enterprise Google Keep notes, download attached media, and adjust note permissions in bulk. Intended for Workspace admins and security tooling. ## Scope Does not handle consumer Keep accounts, note editing, label management, or reminders - use only for enterprise note listing, creation, deletion, media download, and batch permissions. ## Capabilities - List notes in a Workspace user account for security review - Create a new note with a title and body content - Delete a note flagged by a data loss prevention scan - Download a media attachment from a note - Grant note access to multiple principals in a single batch call - Revoke note access from multiple principals in a single batch call ## Use cases ### DLP-triggered note remediation Workspace data loss prevention scanners flag Keep notes that contain credentials, customer PII, or regulated data. A security agent uses the Keep API to fetch the offending note via /v1/{+name}, optionally download attached media for evidence, and call DELETE /v1/{+name} to remove the violation. The API only works with enterprise Workspace accounts, which keeps the workflow within the admin perimeter. Example prompt: Given a note resource name flagged by DLP, GET the note, save the media attachment, then DELETE the note and confirm the response is empty. ### Bulk permission management on shared notes When teams reorganise, security teams need to add or remove access to internal Keep notes for many principals at once. POST /v1/{+parent}/permissions:batchCreate and permissions:batchDelete accept a list of permissions in a single call so the agent can keep ACLs in sync with HR systems without making one request per user. Example prompt: Call POST /v1/notes/{noteId}/permissions:batchCreate with three Permission objects granting WRITER role to three user emails. ### Evidence collection for an investigation During a security investigation an analyst needs the contents of a user's Keep notes preserved before account suspension. Listing notes with GET /v1/notes and downloading media with GET /v1/{+name} produces an evidence trail without touching the user's primary mailbox or drive. Example prompt: List all notes in the target account, then for each note with attachments, download the media file and store it in the evidence bucket. ### Agent-driven Keep cleanup via Jentic A Workspace security agent invoked from a SIEM alert can use Jentic to call the Keep API without learning its resource paths. The agent searches for the right operation in natural language, and Jentic returns the schema for batch permission and delete calls so the agent can act on the alert end-to-end. Example prompt: From an alert with a note resource name, run google_keep_delete_note to remove the note and post a confirmation back to the SIEM. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /v1/notes | List notes in the calling user's Keep account | | POST | /v1/notes | Create a new note | | DELETE | /v1/{+name} | Delete a note by resource name | | GET | /v1/{+name} | Download a media attachment | | POST | /v1/{+parent}/permissions:batchCreate | Grant note access to multiple principals at once | | POST | /v1/{+parent}/permissions:batchDelete | Revoke note access from multiple principals at once | ## Key resources - **notes** — Create, list, get, and delete notes in an enterprise Workspace user's Keep account - **media** — Download media attachments associated with a note - **permissions** — Batch grant or revoke access to a note for multiple principals ## Why Jentic - **Setup:** Wiring the Google Keep API by hand means configuring a Workspace service account with domain-wide delegation, narrowing to the keep scopes, refreshing tokens, and building its note and permission payloads yourself. Through Jentic you install once, import the Google Keep API from the API Directory, store the credential once, and your agent calls it. - **Permission scoping:** Keep creates and lists notes on a shared collection path (/v1/notes), so scope the agent to the operations it needs, such as listing notes or creating a note. You choose the allowed set, so if you grant only the list and get operations the agent can read notes without ever deleting one or changing permissions. - **Credential handling:** Your Workspace service-account credential is stored once, encrypted, by your own Jentic One instance and injected at execution time as a short-lived access token scoped to keep. The JSON key file never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list notes for a workspace user' or 'create a google keep note', and Jentic returns the matching v1 operation with its input schema so the agent uses the right resource-name format without browsing the reference docs. ## Related APIs - **Google Tasks API** — Google Tasks manages structured to-do items with read and write; Keep manages free-form notes - **Google Drive API** — Drive stores documents and files; Keep handles short notes and ideas - **Admin SDK API** — Admin SDK manages Workspace users and groups; Keep accesses the notes those users own ## FAQ ### What authentication does the Google Keep API use? OAuth 2.0 with the https://www.googleapis.com/auth/keep and keep.readonly scopes. The API is restricted to Google Workspace accounts and typically uses domain-wide delegation. Through Jentic the service account credentials stay in the encrypted vault and the agent only ever sees a short-lived access token. ### Can I read consumer Google Keep notes with this API? No. The Keep API only works for enterprise Google Workspace accounts and is intended for admin or security tooling. Consumer Keep accounts have no public API and must be accessed through the Keep app. ### What are the rate limits for the Google Keep API? Google enforces a default quota of 1,200 read and 600 write requests per minute per project, shared across all 6 endpoints. Higher quotas can be requested through the Google Cloud console for large Workspace tenants. ### How do I delete a flagged note through Jentic? Run jentic search 'delete a google keep note' to find the DELETE /v1/{+name} operation, then jentic execute with the note resource name like notes/abc123 to remove it. Jentic handles the OAuth domain-wide delegation behind the scenes. ### Can I share a note with multiple users in one call? Yes. POST /v1/{+parent}/permissions:batchCreate accepts a list of Permission objects so an agent can grant WRITER or COMMENTER access to several users at once, and permissions:batchDelete revokes access in the same way. ### Does the API allow editing existing notes? No. The current v1 API supports list, create, delete, media download, and batch permission changes only. To modify the content of a note you must delete and recreate it. ### Can I limit what my agent is allowed to do with the Google Keep API? Yes. Because you run Jentic One yourself, your own rules decide which Google Keep operations the agent may call and which credential it uses. The API exposes listing notes on /v1/notes, creating a note, deleting a note by resource name, downloading media, and batch permission changes, so you can grant only the operations the task needs. For example, allow list and get so the agent can read notes for a security review while blocking delete and the permissions:batchCreate and permissions:batchDelete calls.