The Problem with Permanent Sharing
Google Drive is an incredible tool for collaboration, but it has a massive security flaw regarding human behavior: people forget to un-share things.
If you share a confidential financial spreadsheet with a third-party contractor for a two-week project, that contractor will retain access to that file indefinitely unless you remember to manually go back in and revoke their permissions months later. In a corporate environment, this leads to a sprawling web of over-privileged external accounts with access to sensitive internal data.
To solve this, Google Drive allows you to set Expiration Dates on shared files. The system will automatically revoke the user’s access at the exact moment the timer runs out. While you can do this manually in the web GUI for single files, managing this at scale requires using the Google Drive API.
Prerequisites for API Usage
Before you can automate this, you must have the following:
- A Google Cloud Platform (GCP) project with the Google Drive API enabled.
- Authentication credentials (like an OAuth 2.0 Client ID or a Service Account key) configured in your script.
- A script written in Python, Node.js, or Google Apps Script. (This guide will use a generic REST API conceptual approach, which translates easily to any language).
Crucial Limitation: Expiration dates can only be applied to users who have “Reader” or “Commenter” roles. You cannot set an expiration date for an “Editor” or an “Owner”.
Step 1: Understanding Permissions in Drive
In the Google Drive API, access is controlled by the permissions resource attached to every file.
To add a user with an expiration date, you are essentially creating a new permission object and sending it to the API via an HTTP POST request to the following endpoint:
POST https://www.googleapis.com/drive/v3/files/[FILE_ID]/permissions
Step 2: Formatting the API Request Body
The magic happens in the JSON body of your API request.
You must specify the user’s email address, their role (which must be reader or commenter), and the exact time their access should vanish, formatted as an RFC 3339 timestamp.
Your JSON payload should look like this:
{
"type": "user",
"role": "reader",
"emailAddress": "[email protected]",
"expirationTime": "2024-12-31T23:59:59Z"
}- type: Usually “user” or “group”.
- role: Set to “reader”.
- expirationTime: This must be in UTC. The “Z” at the end indicates Zulu time (UTC offset zero). If you do not format this string perfectly, the API will reject the request.
Step 3: Updating an Existing Permission
What if the contractor already has access to the file, and you just found out they are leaving next Friday? You don’t want to create a new permission; you need to update their existing one.
First, you must query the file to find the specific permissionId assigned to that contractor’s email address. Once you have that ID, you send an HTTP PATCH request:
PATCH https://www.googleapis.com/drive/v3/files/[FILE_ID]/permissions/[PERMISSION_ID]
The JSON body is much simpler, as you only need to send the field you are changing:
{
"expirationTime": "2023-11-17T17:00:00Z"
}Step 4: Automating with Apps Script
If you don’t want to build a full Python application, you can use Google Apps Script (which runs natively inside Google Drive) to achieve this.
You can write a simple JavaScript loop that searches for files in a specific folder, iterates through the permissions, and applies an expiration date exactly 30 days from the current execution time. By setting this script on a time-driven trigger (e.g., running every midnight), you can ensure that any file placed in your “External Vendor” folder automatically becomes a self-destructing asset, dramatically improving your organization’s data security.