Google Discovery Engine

Google Discovery Engine is the Google Cloud API behind Vertex AI Search and Gemini Enterprise, used to build AI-powered search, recommendation and answer apps over your own structured and unstructured data. The UnifyApps Google discovery engine connector uses the Discovery Engine API to manage data stores, schemas, documents, engines and controls, run searches and generate answers, record user events, and manage Gemini Enterprise user licenses from workflows and agents.

This guide covers every authentication type available on the connection form, and the actions supported, along with the scope and IAM permission each one needs.

Authentication

Before you begin, you should have the following information:

• Connection name: a descriptive name such as MyAppDiscoveryEngineIntegration, so the connection is easy to identify later.

• Authentication type: select the type of authentication for connecting to your Google Cloud project:

  1. Service Account

  2. OAuth

  3. OAuth with Client Credentials

For every authentication type, the Discovery Engine API must be enabled in your Google Cloud project, and the signed-in user or the service account needs a Discovery Engine IAM role on that project, such as Discovery Engine Viewer for read-only actions, Discovery Engine Editor to create and change resources, or Discovery Engine Admin for full access. The connection has no Scopes field: it always requests the cloud-platform scope.

1. Service Account

Use this for server-to-server access, where a Google Cloud service account calls the Discovery Engine API and no user has to sign in.

Step 1: Create a service account in Google Cloud

1. In the Google Cloud Console, select or create a project, and enable the Discovery Engine API under APIs & Services → Library.

2. Go to IAM & Admin → Service Accounts and click Create service account. Enter a name and click Create and continue.

3. Under Permissions, grant the Discovery Engine role the connection needs, for example Discovery Engine Editor, click Continue, then click Done.

4. Open the service account and copy its Email.

5. Go to the Keys tab → Add key → Create new key, choose JSON and click Create. The downloaded file holds the client_email and private_key. Store it securely.

Note: a service account does not need domain-wide delegation for this connector. Its access comes only from the IAM roles it holds on the project.

Step 2: Create the connection in UnifyApps

1. Open Connections → New Connection → Google discovery engine and enter a Connection name.

2. Select Service Account as the Authentication type.

3. Enter the Service account email, the client_email value from the JSON key file (for example my-sa@project-id.iam.gserviceaccount.com).

4. Paste the Private key, the full private_key value from the JSON key file, including the BEGIN PRIVATE KEY and END PRIVATE KEY lines.

5. Click Test Connection to validate the credentials, then click Create.

2. OAuth

Use this when you want to connect with your own Google account and do not need to create a Google Cloud app.

1. Enter a Connection name.

2. Select OAuth as the Authentication type.

3. Click Authorize. You are redirected to the Google sign-in page.

4. Sign in with a Google account that has a Discovery Engine role on the project you want to use.

5. Review the permissions on the consent screen, which ask for access to your Google Cloud data, and click Allow.

6. You are redirected back to UnifyApps with a confirmation that the account is connected.

3. OAuth with Client Credentials

Use this when your organization wants the connection to use its own Google Cloud OAuth client, while actions still run as the Google user who signs in.

Step 1: Create an OAuth client in Google Cloud

1. In the Google Cloud Console, select or create a project, and enable the Discovery Engine API under APIs & Services → Library.

2. Go to Google Auth platform → Branding. If you see Google Auth platform not configured yet, click Get Started, enter an App name, User support email, Audience and contact email, and click Create.

3. Go to Data Access, click Add or Remove Scopes, add the https://www.googleapis.com/auth/cloud-platform scope, and click Save. If the audience is External, add the users who will sign in under Audience → Test users.

4. Go to Google Auth platform → Clients and click Create Client. Choose Web application as the Application type and enter a name.

5. Under Authorized redirect URIs, click Add URI and enter the UnifyApps OAuth callback URL for your environment, which ends in /api/connector-auth-callback/oauth. This connection form does not display it; your UnifyApps administrator can provide it.

6. Click Create, then copy the Client ID and Client secret. Copy the secret immediately: Google shows it only once.

Step 2: Connection setup in UnifyApps

1. Open Connections → New Connection → Google discovery engine and enter a Connection name.

2. Select OAuth with Client Credentials as the Authentication type.

3. Enter the Client ID and Client secret copied from Google Cloud.

4. Click Authorize, sign in with a Google account that has a Discovery Engine role on the project, and click Allow on the consent screen.

5. Confirm the success message after the redirect back to UnifyApps.

Actions

Every action uses the cloud-platform scope (https://www.googleapis.com/auth/cloud-platform), which the connection always requests. What an action may do is then decided by IAM, so each row also names the IAM permission the user or service account needs on the project. The Discovery Engine Viewer, Editor and Admin roles include these permissions for reading, changing and administering resources respectively.