Gong package v1.0.0

A Gong API access key pair (Access Key and Access Key Secret, created by a Gong technical administrator on the company's API page) held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Basic', one separating space, then Base64(<accessKey>:<accessKeySecret>) per RFC 7617 — 'Basic <base64>'. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only.

The retrieved Gong documentation does not state an expiry for the access key pair or a self-serve rotation path — the documented lifecycle control is creation by a technical administrator on the company's API page, so the deployment must treat the pair as valid until revoked in the Gong web app and confirm revocation and rotation terms with Gong before enabling; an external deployment process owns re-issuing the pair and updating the vault entry — the executor injects the stored value verbatim and performs no credential lifecycle itself.

Least privilege: issue a dedicated pair for this integration only and revoke it when the integration is retired; where the OAuth Bearer flow is available, request only the scopes these capabilities need ('api:calls:read:basic', 'api:calls:read:transcript', 'api:users:read', 'api:workspaces:read').

Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

The endpoint host 'gong-instance.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the company's own Gong API base URL host before enabling, in the endpoints, the resource locators and the egress allowlist — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. Gong assigns each company a base URL shown on the company's API authentication page in the Gong web app; the real substitution shape is '{region}.api.gong.io' (for example 'us-0000.api.gong.io').

This pack registers only endpoints the official Gong API V2 reference documents: listing calls by date range, retrieving call transcripts, listing users, and listing workspaces. Reads are collection reads: single-record reads (GET /v2/calls/{id}, GET /v2/users/{id}), the detailed-call query (POST /v2/calls/extensive) and user stats are not registered by this pack.

Documented exclusions: this pack does not register any write path — uploading new calls (POST /v2/calls), adding call media (POST /v2/calls/{id}/media), CRM data upload, permission management including granting users individual access to calls, consent-meeting management, digital-interaction ingestion, and the data-privacy erasure endpoints (deleting all elements associated with an email address or phone number, which are destructive deletes) are all deliberate exclusions, not approximated capabilities.

Gong records and transcribes conversations between the company's team members and external participants, so call and transcript data is classified as pii (personal data); transcripts are the verbatim content of those conversations and carry the highest confidentiality exposure of the four reads.

Credential review completed on 2026-09-21 for a long-lived Basic-auth access key pair held in the customer's vault. The requirements and limits are below.

Issuance authority and delegation: a Gong technical administrator creates the Access Key and Access Key Secret pair on the company's API page, so issuance authority sits with the customer's own administrator.

Scope: the retrieved Gong documentation establishes no per-pair scoping for the Basic credential — per-endpoint scopes (api:calls:read:basic, api:calls:read:transcript, api:users:read, api:workspaces:read) exist only in the OAuth Bearer flow — so the least-privilege posture is a dedicated pair for this integration only, revoked when the integration is retired, and this pack makes no scoping claim for the pair itself.

Audience: no audience mechanism is documented — the Basic credential authorizes against the company's own base URL ('{region}.api.gong.io'), and audience binding beyond that is not established. TTL: the reviewed documentation states no expiry for the pair, so the completed review documents none: the deployment must treat the pair as valid until revoked and confirm lifecycle terms with Gong before enabling.

Refresh ownership: there is no refresh — re-issuing the pair and updating the vault entry is an external deployment process, and the executor injects the stored value verbatim and performs no credential lifecycle itself.

Revocation: the reviewed documentation describes no self-serve revocation or rotation path for the pair — the completed review documents this gap, the cut-off path is revocation in the Gong web app as the deployment confirms with Gong, and this pack makes no stronger claim. Executor access and replay/exposure: the executor reads only the vault reference; the pair is a Basic credential replayable with no documented TTL bound — so the vault reference is the only place the value may live.

Alternate access paths: the Gong web app, OAuth apps and any other key pairs retain access outside this pack, and revoking this pair closes only this path. Gong's OAuth 2.0 Bearer flow with per-endpoint scopes (available to published apps) remains one candidate stronger model, not an automatic pass. The credential review is complete. Assign accountable owners before deployment.