ChartPull’s core org chart works with a single OAuth scope. To unlock advanced features — Google Groups, calendar resources, admin role auditing, login activity, and more — you can grant additional read-only scopes through Domain-Wide Delegation (DWD) in your Google Admin Console.
What is Domain-Wide Delegation?
Domain-Wide Delegation lets a Google Cloud service account act on behalf of users in your organisation — without each user signing in individually. ChartPull uses a service account with read-only scopes only. No data is ever modified. DWD scopes are configured by your Google Workspace admin and are invisible to Google Marketplace review — they cost $0.| Google API Scope | Feature Unlocked | Plan Required |
|---|---|---|
admin.directory.group.readonly + admin.directory.group.member.readonly | Google Groups | Integrations add-on |
admin.directory.resource.calendar.readonly | Office & Floor Mapping | Integrations add-on |
admin.directory.domain.readonly | Multi-Domain Support | Integrations add-on |
calendar.freebusy | Calendar Availability | Integrations add-on |
admin.directory.rolemanagement.readonly | Admin Role Visualization | AI add-on |
admin.reports.usage.readonly + admin.reports.audit.readonly | Login Intelligence + Shadow IT | AI add-on |
All scopes are read-only
Every scope listed above is a readonly scope. ChartPull cannot modify users, groups, calendars, or admin settings. Your data stays exactly as-is in Google.Open Google Admin Console
Go to admin.google.com and sign in with your Google Workspace Super Admin account. Navigate to Security > Access and data control > API controls > Domain-wide Delegation.
Click "Add new"
Click the "Add new" button to add a new API client. You will need ChartPull's service account client ID, which you can find in ChartPull at Admin > Settings > Advanced Scopes.
Enter the Client ID and scopes
Paste the ChartPull service account client ID into the "Client ID" field. In the "OAuth scopes" field, paste the comma-separated scope URIs for the features you want to enable (see the scope URIs below).
Click Authorise
Click the "Authorise" button. The scopes take effect immediately. Return to ChartPull and click "Sync Now" to pull in the new data.
Copy and paste these into the “OAuth scopes” field in Google Admin Console. You can add all scopes at once or just the ones for the features you need.
https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly, https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/calendar.freebusy
https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly, https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/calendar.freebusy, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly, https://www.googleapis.com/auth/admin.reports.usage.readonly, https://www.googleapis.com/auth/admin.reports.audit.readonly