Google Chat
Send Safeguard notifications to a Google Chat space, and optionally let a Chat app answer questions there. What the webhook needs and step-by-step setup.
Availability
This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.
What it does
The Google Chat card sends Safeguard notifications (new findings, scan results and alerts) to a Google Chat space through the space's incoming webhook. Optionally, a Google Chat app can answer questions when someone mentions it in that space. Find the card under Integrations on the Notification tab.
Public vs private
This does not apply to Google Chat: you always connect a space in your own Google Workspace.
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Incoming webhook URL of the space | All notification connections | Required by the dialog (Webhook URL) |
| Google Chat app events (the Bot (optional) step) | You want answers in the space as well | Needs a Chat app whose HTTP endpoint points to Safeguard, and its Google Cloud Project Number |
Permissions required
Safeguard only posts messages through the webhook. It never reads the space's messages or members through it.
| Permission | Required? | What Safeguard uses it for |
|---|---|---|
| The space's incoming webhook URL | Required | Posting notifications. The URL carries a key and a token; the token is the secret |
| Your organization allows incoming webhooks | Required | Google Workspace admins can turn webhooks off; then none can be created |
| Google Cloud project number of the Chat app | Optional | The dialog uses it to verify inbound Chat app events |
Least privilege: one webhook per space, used only by Safeguard.
Token types
| Credential | Works? | Notes |
|---|---|---|
Space incoming webhook URL (https://chat.googleapis.com/v1/spaces/...) | Yes | Needs a Business or Enterprise Google Workspace account |
| Personal Google account | No | Google offers incoming webhooks to Workspace accounts only |
| Service account key | No | The dialog takes a webhook URL, not a service account |
Expiry: webhook URLs do not expire. Delete the webhook in the space to revoke it.
What we never need: Google Workspace admin roles, Chat API scopes for reading messages, or any Google Drive or Gmail access.
Step-by-step setup
Create the credential in Google Chat
- Open Google Chat in a browser and go to the space.
- Click the arrow next to the space title and select Apps & integrations.
- Click Add webhooks, enter a name (and an avatar URL if you like) and click Save.
- Open the webhook's More menu and select Copy link. Keep the URL secret.
Or check it with curl
curl -s -H "Content-Type: application/json; charset=UTF-8" -d '{"text":"Safeguard test"}' "<webhook-url>"Connect it in Safeguard
- Open Integrations and choose the Notification tab.
- Click Connect on the Google Chat card.
- Enter an Integration Name, an optional Description, and paste the Webhook URL. Optionally enter the Space Name.
- Click Next. On Bot (optional), leave Google Cloud Project Number empty for notifications only. For answers in the space, enter your Chat app's project number and set the Chat app's HTTP endpoint to
https://api.safeguard.sh/scm/api/v1/google-chat/events. - Click Connect.
Webhooks and triggers
Notifications are sent when the events you subscribed to happen (for example a scan finishing or a new critical finding). With the optional Chat app, Google Chat sends message events to https://api.safeguard.sh/scm/api/v1/google-chat/events; Safeguard verifies each event's token and finds the connection from the event's space.
What we read and store
- Read: nothing for notifications. With the Chat app, the messages that mention it in the space.
- Stored: the connection's name, space name, project number and the webhook URL. Safeguard never shows the URL again in the dialog.
- Sent to Google Chat: notification text about your Safeguard projects and findings.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
| Connect stays disabled | The Webhook URL does not start with https://, or the name is empty or already used | Paste the full webhook URL and a unique name |
Failed to save Google Chat configuration | The connection could not be saved | Check the URL and try again |
Safeguard is not linked to this space yet. ... (in the space) | The Chat app was mentioned in a space with no Safeguard connection | Add this space's webhook under Integrations, then mention the app again |
| Messages do not arrive | The webhook was deleted, or webhooks are turned off for your organization | Create a new webhook, or ask your Workspace admin to allow incoming webhooks |
Google limits webhook posts to about one per second per space, so a burst of notifications can be slowed down.
Rotation and disconnect
- Rotate: add a new webhook in the space, open the Google Chat connection on the Notification tab, choose Update, paste the new URL and choose Save Changes. Then delete the old webhook in the space.
- Disconnect: choose Delete on the connection, then delete the webhook under the space's Apps & integrations.
Vendor references
- Build a Google Chat app as a webhook, checked 2026-10-16.