Got contracted by a client to work with their Google Workspace account and automate security features.

For reference:

https://developers.google.com/admin-sdk/alertcenter/reference/alert-types

https://developers.google.com/admin-sdk/alertcenter/reference/rest/v1beta1/MailPhishing

https://developers.google.com/admin-sdk/alertcenter/reference/rest/v1beta1/GmailMessageInfo

https://developers.google.com/gmail/api/reference/rest/v1/users.messages

https://developers.google.com/gmail/api/reference/rest/v1/users.messages.attachments

• Why are there "Suspicious message reported" and "User reported Phishing" categories but there is no "User reported spam"? Is "Suspicious" actually "Spam"? Or Phishing? It is not explained in documentation. The user interface in Gmail only has two button to report emails. Spam and Phishing. What do you mean by "Suspicious message"?

• Why is there no way to download attachments or entire mail headers + body with the alert center API? How are we expected to analyze suspicious emails?

• If we have to use the Gmail API, why is the messageId that comes within the alert message list different from the ID used in the Gmail api to retrieve messages? How are we supposed to get the entire message? I couldnt find an API that translates one into the another.

• Regarding hashes that come inside "attachmentsSha256Hash[]": It is not specified to what each belongs to. Is the first one always related to the body? Or to what MIME part? Sometimes there is only 1 value, some others 2 and some others 3 or more.

• Why when the client gets email from domains that are not under their control the "isInternal" value is set to true? This should be set to false.

I can expect this kind of errors and confusion from a small startup or SaaS with a low price tag but not from a company with such trajectory and that tries to compete with O365. This is unacceptable.