To grant a named person Drive API access, create a permission for that specific identity and required role. Do not use type=anyone as a convenient default. OAuth scope, the acting user’s capabilities, and organizational policy all constrain the operation.
Verify the original and sharing authority
Identify the target file by its verified ID and inspect the current user’s canShare capability. Google recommends capabilities for action availability rather than inferring every action directly from a role label.
Check inherited permissions and the current audience. A child file cannot normally reduce access inherited from its parent, and shared-drive rules can limit external or non-member sharing.
Create the narrow permission
Use the documented permissions.create method for the intended file. An illustrative read-only individual permission uses type: user, role: reader, and the exact authorized emailAddress. The API reader role corresponds to a viewing capability, not edit authority.
Choose group or other permission types only when the actual audience requires them. Review notification behavior separately before production use; sending or suppressing an email does not determine whether the permission itself exists.
Verify the resulting access
Keep the returned permission ID and inspect the effective state. Test the intended recipient identity through a controlled authorized workflow when appropriate. A listed direct entry can still be blocked by stricter organization or shared-drive restrictions. Avoid concurrent conflicting permission mutations and reconcile unknown outcomes before retrying. Do not claim a revocation retrieves downloaded copies or that one successful create makes the entire parent folder private. Log only the minimum sensitive account and file details needed for operational evidence.
References
- Share files, folders, and drives | Google Drive | Google for Developers
- Choose Google Drive API scopes | Google for Developers
Reviewed against the linked official product guidance on November 3, 2026. Features, limits, screen labels, and access can vary by account, platform, region, and organization policy.