{
  "schema": "aaes/capability-pack/1",
  "provider": "gong",
  "version": "1.0.0",
  "description": "Read Gong calls, transcripts, users, and workspaces in one company instance. Transcripts contain the conversation itself, including identifiable participants.",
  "notes": "The endpoint host 'gong-instance.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the company's own Gong API base URL host before enabling, in the endpoints, the resource locators and the egress allowlist — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. Gong assigns each company a base URL shown on the company's API authentication page in the Gong web app; the real substitution shape is '{region}.api.gong.io' (for example 'us-0000.api.gong.io').\n\nThis pack registers only endpoints the official Gong API V2 reference documents: listing calls by date range, retrieving call transcripts, listing users, and listing workspaces. Reads are collection reads: single-record reads (GET /v2/calls/{id}, GET /v2/users/{id}), the detailed-call query (POST /v2/calls/extensive) and user stats are not registered by this pack.\n\nDocumented exclusions: this pack does not register any write path — uploading new calls (POST /v2/calls), adding call media (POST /v2/calls/{id}/media), CRM data upload, permission management including granting users individual access to calls, consent-meeting management, digital-interaction ingestion, and the data-privacy erasure endpoints (deleting all elements associated with an email address or phone number, which are destructive deletes) are all deliberate exclusions, not approximated capabilities.\n\nGong records and transcribes conversations between the company's team members and external participants, so call and transcript data is classified as pii (personal data); transcripts are the verbatim content of those conversations and carry the highest confidentiality exposure of the four reads.\n\nCredential review completed on 2026-09-21 for a long-lived Basic-auth access key pair held in the customer's vault. The requirements and limits are below.\n\nIssuance authority and delegation: a Gong technical administrator creates the Access Key and Access Key Secret pair on the company's API page, so issuance authority sits with the customer's own administrator.\n\nScope: the retrieved Gong documentation establishes no per-pair scoping for the Basic credential — per-endpoint scopes (api:calls:read:basic, api:calls:read:transcript, api:users:read, api:workspaces:read) exist only in the OAuth Bearer flow — so the least-privilege posture is a dedicated pair for this integration only, revoked when the integration is retired, and this pack makes no scoping claim for the pair itself.\n\nAudience: no audience mechanism is documented — the Basic credential authorizes against the company's own base URL ('{region}.api.gong.io'), and audience binding beyond that is not established. TTL: the reviewed documentation states no expiry for the pair, so the completed review documents none: the deployment must treat the pair as valid until revoked and confirm lifecycle terms with Gong before enabling.\n\nRefresh ownership: there is no refresh — re-issuing the pair and updating the vault entry is an external deployment process, and the executor injects the stored value verbatim and performs no credential lifecycle itself.\n\nRevocation: the reviewed documentation describes no self-serve revocation or rotation path for the pair — the completed review documents this gap, the cut-off path is revocation in the Gong web app as the deployment confirms with Gong, and this pack makes no stronger claim. Executor access and replay/exposure: the executor reads only the vault reference; the pair is a Basic credential replayable with no documented TTL bound — so the vault reference is the only place the value may live.\n\nAlternate access paths: the Gong web app, OAuth apps and any other key pairs retain access outside this pack, and revoking this pair closes only this path. Gong's OAuth 2.0 Bearer flow with per-endpoint scopes (available to published apps) remains one candidate stronger model, not an automatic pass. The credential review is complete. Assign accountable owners before deployment.",
  "credential": {
    "secret_ref_id": "secret-ref-gong-access-key",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "A Gong API access key pair (Access Key and Access Key Secret, created by a Gong technical administrator on the company's API page) held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Basic', one separating space, then Base64(<accessKey>:<accessKeySecret>) per RFC 7617 — 'Basic <base64>'. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only.\n\nThe retrieved Gong documentation does not state an expiry for the access key pair or a self-serve rotation path — the documented lifecycle control is creation by a technical administrator on the company's API page, so the deployment must treat the pair as valid until revoked in the Gong web app and confirm revocation and rotation terms with Gong before enabling; an external deployment process owns re-issuing the pair and updating the vault entry — the executor injects the stored value verbatim and performs no credential lifecycle itself.\n\nLeast privilege: issue a dedicated pair for this integration only and revoke it when the integration is retired; where the OAuth Bearer flow is available, request only the scopes these capabilities need ('api:calls:read:basic', 'api:calls:read:transcript', 'api:users:read', 'api:workspaces:read').\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack."
  },
  "capabilities": [
    {
      "capability_id": "gong.calls.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "gong-instance.invalid"
      ],
      "endpoint": "https://gong-instance.invalid/v2/calls",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-gong-access-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "gong-company-calls",
      "description": "List calls that took place during a date range (fromDateTime and toDateTime are required query parameters; results are cursor-paginated). Each call record carries title, schedule, duration, direction, the hosting user's id and whether the call is private — metadata about identifiable people's conversations, classified as pii (personal data). The registered path covers the collection read only — single-call reads (GET /v2/calls/{id}) and the detailed-call query (POST /v2/calls/extensive) are not registered by this pack.",
      "requires_review": true
    },
    {
      "capability_id": "gong.calls.transcripts.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "gong-instance.invalid"
      ],
      "endpoint": "https://gong-instance.invalid/v2/calls/transcript",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-gong-access-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "gong-company-calls",
      "description": "Retrieve transcripts of calls for a date range or a list of call ids. The method is POST because the filter travels in a request body; the documented effect is retrieval only — no Gong state is created or changed. The response is the verbatim content of conversations between team members and external participants, attributed by speaker id, classified as pii (personal data); this is the highest-confidentiality read in the pack even though the read action's tier floor is R0.",
      "requires_review": true
    },
    {
      "capability_id": "gong.users.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "gong-instance.invalid"
      ],
      "endpoint": "https://gong-instance.invalid/v2/users",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-gong-access-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "gong-company-users",
      "description": "List all of the company's Gong users (cursor-paginated): names, email addresses and aliases, phone numbers, job titles, manager links and recording settings — employee personal data, classified as pii (personal data). The registered path covers the collection read only — single-user reads (GET /v2/users/{id}) and user settings history are not registered by this pack.",
      "requires_review": true
    },
    {
      "capability_id": "gong.workspaces.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "gong-instance.invalid"
      ],
      "endpoint": "https://gong-instance.invalid/v2/workspaces",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-gong-access-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "gong-company-workspaces",
      "description": "List all company workspaces with their ids, names and descriptions — internal org-structure information, classified as internal data. The registered path covers the collection read only.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "gong-company-calls",
      "kind": "api",
      "locator": "https://gong-instance.invalid/v2/calls",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "gong-company-users",
      "kind": "api",
      "locator": "https://gong-instance.invalid/v2/users",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "gong-company-workspaces",
      "kind": "api",
      "locator": "https://gong-instance.invalid/v2/workspaces",
      "data_class": "internal",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-22",
    "sources": [
      "https://help.gong.io/apidocs/introduction-2.md (retrieved 2026-09-21)",
      "https://help.gong.io/apidocs/retrieve-call-data-by-date-range-v2calls-2.md (retrieved 2026-09-21)",
      "https://help.gong.io/apidocs/retrieve-transcripts-of-calls-by-date-or-callids-v2callstranscript-2.md (retrieved 2026-09-21)",
      "https://help.gong.io/apidocs/list-all-users-v2users.md (retrieved 2026-09-21)",
      "https://help.gong.io/apidocs/list-all-company-workspaces-v2workspaces.md (retrieved 2026-09-21)",
      "https://help.gong.io/docs/what-the-gong-api-provides (retrieved 2026-09-21)",
      "https://help.gong.io/docs/create-an-app-for-gong (retrieved 2026-09-21)"
    ],
    "reviewer_id": "aaes-eng"
  }
}