Google Keep

Google Keep is the note taking app in Google Workspace, and its API serves Workspace accounts only. Agents list, read, create, and delete notes, share them with people and groups, and download attachments.

Verified 7 actions OAuth available

Google Keep website Platform Documentation Capability data verified 2026-08-24

A scheduled Workspace content review starts, or a security tool flags Keep as a location worth checking

List Notes returns the notes the administrator credential can reach, and Get Note pulls each body, its list items, and its permission map

The agent matches bodies against the patterns the organization does not allow in Keep, such as credentials, account numbers, and customer identifiers

Download Attachment pulls the images and files on flagged notes into FlowRunner file storage so the finding has evidence attached

The agent confirms who currently holds access to each flagged note and which of them still work here

The findings reach the Workspace administrator with the note, the collaborator list, and the matched text quoted in place

The administrator chooses Unshare Note or Delete Note, because this API offers no way to edit the note and leave it standing

What This Integration Enables

Google Keep is the note app nobody administers. The published API is deliberately narrow, and Google's own framing is that it exists so Workspace administrators can manage Keep content and resolve issues that cloud security software has already surfaced. That is the honest shape of this connector: seven methods, no update route, no labels, no colors, no reminders, and no way to reach a personal account. FlowRunner agents list and read notes, create new ones, share and unshare them, download their attachments, and delete them. That is the whole surface, and it is exactly the surface a governance workflow needs.

The missing update route is the interesting constraint. Because a note's contents cannot be changed once created, an agent that finds something it should not have found has no quiet fix available. It cannot redact. It can only cut access or destroy the note, and both of those are decisions with owners. This is where FlowRunner's human-in-the-loop design does real work rather than decorative work: the agent does the reading, the matching, and the evidence gathering across an entire Workspace, and the two operations that cannot be walked back wait for the person accountable for them. Every action here is built and verified against the Google Keep API.

Without FlowRunner

Keep is a blind spot Notes are personal by default, so nobody knows what is in them until something goes wrong

Review is a volunteer effort Checking note contents by hand is nobody's job, so it happens after an incident rather than before one

Access outlives people A collaborator added to a note two years ago still holds write access to it, and no report says so

With FlowRunner

Keep is inspectable on a schedule An agent reads the notes the administrator credential can reach and reports what it found

Findings arrive with evidence Each flag carries the note, the matched text, the attachments, and the current collaborator list

Removal is a decision, not a script The agent gathers everything; a person picks between cutting access and destroying the note

Use Case Scenarios

A standing content review over Keep

On a schedule, the agent walks Keep with List Notes and pulls each one with Get Note. It matches bodies and list items against the patterns the organization treats as out of place in an unmanaged note app, and it reads each note's permission map to see who else holds it. Attachments on flagged notes come down through Download Attachment so the finding is reviewable without anyone opening Keep. The results append to a sheet in Google Sheets and a summary posts to the security channel in Slack. Nothing is removed by the sweep. The sweep exists to produce a list a person can work through.
Offboarding that actually reaches the notes

When an HR system marks a departure, the offboarding flow already revokes the obvious things. Keep is usually not one of them. Here the agent reads the notes the administrator credential can see, finds the ones the leaver holds a permission on, and calls Unshare Note to remove that permission. Where the leaver is the owner of a note others depend on, the agent cannot transfer ownership through this API, so it raises that note to the manager instead of pretending it handled it. The ones it can close, it closes. The ones it cannot, it names.
Handing an incident its written context

A support or incident workflow needs a durable note that the responding group can all see. The agent calls Create Note with either a text body or a checklist, since Keep accepts one or the other and never both, then calls Share Note to add the responders. Because Share Note can only grant the WRITER role, everyone added can edit, and the agent states that in the note it writes rather than leaving the team to discover it. When the incident closes, a separate flow calls Unshare Note to bring the audience back down. Related tickets and timelines stay in Zendesk or ServiceNow; the note is the scratch surface beside them.

Human-in-Loop Highlight

The gate on this connector exists because the safe middle option does not exist in the API. When the review agent finds a live credential pasted into a Keep note shared with four people, it cannot edit the note to take the credential out. Google publishes no update route. Its two remaining moves are Unshare Note, which removes collaborators immediately but leaves the content intact under its owner, and Delete Note, which Google describes as removing the resource immediately, with no undo and no trip through the trash, taking every collaborator's access with it and requiring the caller to hold the OWNER role. So the agent stops and asks the Workspace administrator in Slack: "Note titled 'staging setup' contains what looks like a live API key. Four collaborators, all WRITER, one of them left in March. Unshare all four and leave the note with its owner, or delete the note outright? There is no third option; this API cannot edit the note." The administrator answers, and the agent carries out that one call and records what was chosen and by whom.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via Slack

Human decides

Agent resumes with decision

Agent Capabilities

7 actions

Notes

List Notes Returns the notes this account can reach. Trashed notes are excluded unless a filter asks for them, which is the usual reason a review sweep comes back thinner than expected.
Get Note Returns one note with its body, its attachments, and its permission map. This is the read that tells a governance flow both what a note says and who else holds it.
Create Note Creates a note with either a text body or a list of items, never both. Used when a workflow needs to leave durable written context somewhere a group already looks.
Delete Note Deletes a note immediately and permanently. It is not a move to the trash, every collaborator loses access, and the caller must hold the OWNER role. This is the operation this page's human gate exists for.

Sharing

Share Note Adds collaborators to a note. Only the WRITER role can be granted, so there is no read-only share, and if any single permission in the call fails the whole call fails and nothing changes.
Unshare Note Removes collaborators from a note, and they lose access at once. The OWNER permission cannot be removed, and naming a permission that does not exist fails the whole call without changing anything.

Attachments

Download Attachment Downloads a note attachment into FlowRunner file storage so a finding, a record, or a downstream review has the file itself rather than a reference to it. The MIME type requested has to be one the attachment actually offers.

Frequently Asked Questions

What can FlowRunner do with Google Keep?

FlowRunner agents can run List Notes, Get Note, and Create Note in Google Keep, plus 4 more actions.

Does connecting Google Keep to FlowRunner require OAuth?

Yes. Google Keep connects to FlowRunner with OAuth 2.0, so agents authenticate without handling raw credentials.

Can Google Keep trigger a FlowRunner workflow automatically?

Google Keep doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.

Start building with Google Keep

Free plan, no card required. Connect in minutes.

Start Building Free Talk to us