Drive Access API

Authentication

All endpoints require a PortEden Access Token via Bearer authentication:

Authorization: Bearer pe_k1_abc123def456... 

The token must have:

• driveAccessEnabled: true
• At least one connected Google Drive provider with drive scopes
• The relevant operation flag enabled in allowedDriveOperations

Access Control Model

Drive access uses a three-layer security model. The token must pass all layers for each request.

Layer 1: Operation Permissions

Each token has an allowedDriveOperations bitflag that controls which API operations it can perform.

Layer 2: Drive Rules (File-Level Firewall)

Drive rules determine which specific files the token can access. Rules are evaluated per-file against the file's properties.

Evaluation Order

1. If no rules exist at all, the driveAllowAll default applies
2. Each rule is checked against the file (case-insensitive exact match or wildcard for mime_type)
3. If any block rule matches → file is blocked (block always wins)
4. If any allow rule matches → file is allowed
5. If no rule matches → falls back to driveAllowAll default

Example: Allow Everything Except Sensitive Content

{ 
  "driveAllowAll": true, 
  "rules": [ 
    { "ruleType": "folder", "pattern": "google:0B7_HR_CONFIDENTIAL", "action": "block" }, 
    { "ruleType": "mime_type", "pattern": "application/vnd.google-apps.spreadsheet", "action": "block" } 
  ] 
} 

Result: All files accessible except those in the HR folder and all spreadsheets.

Endpoint Sections

HTTP Status Codes

Drive Error Codes

Supported Providers