βeta
Request a Demo

Connections and permissions

Exact default access for Google and Microsoft, plus LinkedIn, X, uploads, and revocation.

01

Which Google permissions does Graph One request?

By default, we ask for read-only email metadata and read-only calendar events.

Google also handles sign-in and consent. We ask for offline access so a user-led sync can run after the browser session ends.

Current default Google scopes

Exact scope
What it allows
https://www.googleapis.com/auth/gmail.metadata Read message labels and headers, but not the email body.
https://www.googleapis.com/auth/calendar.events.readonly Read calendar events. We cannot create, change, or delete them.
Google Gmail scope guide Google OAuth guide
02

What is the Microsoft application ID?

10769677-c47f-4c50-af8b-6e57b1dffce9

An application ID is public. We never show the application secret.

Application name
Graph One
Application (client) ID
10769677-c47f-4c50-af8b-6e57b1dffce9
Access type
Delegated access on behalf of the signed-in user
Contact Us
03

Which Microsoft permissions does Graph One request?

We ask for sign-in, basic mail, and read-only calendar access for the signed-in user.

These are delegated permissions. They do not give us app-only access to every mailbox in a company.

Current default Microsoft scopes

Exact scope
What it allows
openid Sign the user in with OpenID Connect.
email Read the signed-in user's email claim when Microsoft provides it.
Mail.ReadBasic Read basic mail fields. It excludes body, preview, attachments, and extensions.
Mail.ReadBasic.Shared Read the same basic fields in mailboxes the signed-in user can already access.
offline_access Issue a refresh token so a user-led sync can continue when the user is away.
profile Read basic profile claims used for sign-in.
User.Read Read the signed-in user's basic Microsoft profile.
Calendars.Read Read the signed-in user's calendar events.
Calendars.Read.Shared Read calendars the signed-in user can already access.
Microsoft Graph permission guide Microsoft OpenID scope guide
04

Why are shared Microsoft permissions listed?

They let us read basic mail or calendar data that the signed-in user already has permission to see.

The shared scopes do not grant access to all shared mailboxes or calendars in the tenant. Microsoft checks the user's own access.

Microsoft Graph permission guide
06

Can Graph One ask for wider permissions later?

Yes, but we do so only for a feature that needs them and through a new provider consent step.

The wider Google and Microsoft scopes are not part of the default lists shown above.

  • Read email body for features that need message text.
  • Send or change email when a user starts that action.
  • Create or change calendar events.
  • Read or change contacts.
07

What LinkedIn or X data can Graph One receive?

Users can connect supported LinkedIn access or upload a LinkedIn or X archive.

LinkedIn access can use LinkedIn sign-in and Unipile for profile, connection, search, and message features. Archive uploads are checked for malware before we accept them.

An import only gives us the files and fields in the archive. It does not give us the user's account password.

Unipile privacy
08

How can a user stop access?

Disconnect the source in Graph One, then revoke our access in the provider's account controls.

Disconnecting stops new sync work and starts the source cleanup that applies to that connection. Revoking at the provider makes its tokens unusable. Full account deletion removes all linked sources.

Google third-party access Microsoft app access Deletion details