# Settings no API shows: the intake

No Admin API resource exists for data filters, internal traffic rules, unwanted referrals, the cross-domain list, session timeout, consent settings, diagnostics, behavioural modelling status or GA4 conversion settings; the change history method needs analytics.edit; and the measurementProtocolSecrets method returns secret values, so it is never called. The user (or the agent, from the user's screenshots) fills [../assets/ui-settings-intake.csv](../assets/ui-settings-intake.csv), one row per setting.

Columns: `setting_id`, `where_to_find`, `value`, `evidence` (screenshot file name or exported file), `read_by` (a role, not a name), `read_at` (date), `notes`. An empty `value` means not supplied, and the rules that need it become NOT CHECKED. `none` means supplied and empty. Screenshots follow the rules under "Never copy": crop before sharing.

The menu paths were read from Google's help pages on 2026-11-01. Paths move; confirm each one in the property at run time and correct the CSV.

## Value formats

- Lists: items separated by semicolons. Conditions: `match:value`, where match is exact, contains, begins_with, ends_with or regex; a bare value counts as contains.
- Key-value rows: `key=value; key=value`. Inside a key-value row, join several conditions with a vertical bar.
- Dates: YYYY-MM-DD. Shares: a number with or without %.

## Google tag settings (Admin, Data collection and modification, Data streams, the web stream, Configure tag settings)

- `tag.domains`, Configure your domains: the conditions, for example `contains:example.com; exact:shop.example.net`. Rule G10.
- `tag.unwanted_referrals`, List unwanted referrals: the conditions or `none`. Up to 50 per stream. Rule G09.
- `tag.internal_traffic_rules`, Define internal traffic: `Rule name=traffic_type value` per rule, for example `Office=internal`. Never copy the IP addresses or ranges. Rule G06.
- `tag.session_timeout_minutes` and `tag.engaged_session_seconds`, Adjust session timeout: numbers (defaults 30 and 10). Rule G10.
- `tag.cookie_override`, Override cookie settings: on or off. Rule G10.
- `tag.consent_mode_override`, Set consent mode override: the regions, or off. It works only when Manage default consent settings is No. Rule G23.
- `tag.manage_default_consent`, Manage default consent settings: Yes or No. Yes labels all data sent to Google as consented when consent mode is not used; Google does not apply it when consent mode is used. Rule G23.
- `tag.user_provided_data`, Allow user-provided data capabilities: on or off and the methods. Context for G24; the API setting is used when the snapshot has it.
- `tag.coverage`, Google tag, Tag coverage summary: `tagged=N; not_tagged=N; no_recent_activity=N; key_paths_not_tagged=path|path` or `none`, or pass the downloaded CSV with `--tag-coverage`. Rule G02.

These rows describe the main production web stream. For a second production web stream, add rows suffixed with `@` and the stream name; the script rates only the unsuffixed rows, so the agent reviews the suffixed ones by hand and notes the result.

## Data filters (Admin, Data collection and modification, Data filters)

- `filters.1`, `filters.2` and so on, one per filter: `name=...; type=internal|developer|hostname; operation=exclude|include; value=...` (internal filters: the traffic_type value) `; conditions=...` (hostname filters) `; state=active|testing|inactive; since=YYYY-MM-DD`.
- `since` is the date the filter entered its current state, from the filter page or the change history.
- A single row `filters.1` with value `none` records that the property has no filters. Rules G06, G07, G08.

## Consent (Admin, Data collection and modification, Consent settings)

- `consent.eea_share`: `traffic=38%; key_events=35%` as the page shows them. Rule G23.
- `consent.stream.NAME`, one row per stream, NAME as the stream's display name: `ad_user_data=received|not received; ad_personalization=received|not received; behavior_analytics=ok|flagged`. Copy the page's wording if it differs; "not detected" and "missing" count as not received. Rule G23.
- `collection.regions` (Admin, Data collection and modification, Data collection): `google_signals=...; granular_location_device=...; ads_personalization=...`. Context for G05 and G23; not scored.
- `identity.modeling` (the data quality icon on any report while the identity is Blended): the icon text, for example `including estimated user data`, `excluding estimated user data`, or `estimated user data unavailable: not eligible`. Rule G05 and the analyst caveats.

## GA4 conversions (Advertising, Tools, Conversion management)

- `conversions.NAME`, one row per conversion shared with Google Ads: `key_event=...; counting=...` (as the screen shows it) `; click_window_days=N; engaged_view_window_days=N; channels=...`. The feature is not available on every property, nor on subproperties and roll-ups; write `none` when the page is absent. Rule G16.

## Diagnostics, history and links

- `diagnostics.N` (property notifications, diagnostics and Task Assistant data issues): `first_seen=YYYY-MM-DD; summary=...; owner=role or none`, or `none`. Rule G26.
- `change_history.N` (Admin, Property change history): `date=YYYY-MM-DD; area=attribution|channel_groups|filters|key_events|retention|consent|other; change=...; role=...`. Record the role, never the person's name or email. Only changes from the last 12 months. Rules G21, G22, G26.
- `mp_secrets.STREAM` (Data streams, the stream, Measurement Protocol API secrets): `count=N; owner=system that uses it`. Never copy a secret value. Rule G24.
- `links.not_in_api` (Admin, Product links): Search Console, Merchant Center, Ad Manager and other links present. Inventory only.

## Settings to transcribe on routes A and C

When the Admin API is not available, transcribe these from the screens into the snapshot (shape in [reading-sources.md](reading-sources.md#snapshot-shape)), with a screenshot each:

- Property details: time zone, currency, service level (Admin, Property details).
- Data retention: event and user data retention, reset on new activity (Admin, Data collection and modification, Data retention).
- Key events, on route C only (route A reads them with `list_key_events`): name, counting method, default value (Admin, Data display, Events, then each key event's settings). Mark `deletable` only if the screen shows it.
- Enhanced measurement and data redaction: per web stream (Data streams, the stream).
- Attribution settings and reporting identity (Admin, Data display).
- BigQuery links: project, location, daily and streaming flags, streams, excluded events (Admin, Product links, BigQuery links).
- Channel groups: names in order and which is primary (Admin, Data display, Channel groups).

## Never copy

- IP addresses or ranges, Measurement Protocol secret values, tokens or keys.
- Names or emails of people in change history, access lists or Google Ads link creators.
- Raw URLs holding personal data. Record host, path and the key name instead.
- The same applies to screenshots: crop or blur the Secret value column, IP conditions in Define internal traffic, and names or emails in change history and link details before a screenshot is shared or kept as evidence. An `mp_secrets` row takes count and owner as text, with no screenshot unless the Secret value column is cropped.