fix(source-google-analytics-data-api, source-google-search-console): add access_token to extract_output to fix OAuth secretId 422 regression (#76190)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>
Co-authored-by: Serhii Lazebnyi <gl_serhii.lazebnyi@airbyte.io>

Author: 3 people

airbyte-integrations/connectors/source-google-analytics-data-api/manifest.yaml

@@ -2992,6 +2992,7 @@ spec:
         access_token_url: "https://oauth2.googleapis.com/token?{{client_id_param}}&{{client_secret_param}}&{{auth_code_param}}&{{redirect_uri_param}}&grant_type=authorization_code"
         extract_output:
           - refresh_token
+          - access_token
       complete_oauth_output_specification:
         type: object
         properties:

airbyte-integrations/connectors/source-google-analytics-data-api/metadata.yaml

@@ -12,7 +12,7 @@ data:
   connectorSubtype: api
   connectorType: source
   definitionId: 3cc2eafd-84aa-4dca-93af-322d9dfeec1a
-  dockerImageTag: 2.9.29
+  dockerImageTag: 2.9.30
   dockerRepository: airbyte/source-google-analytics-data-api
   documentationUrl: https://docs.airbyte.com/integrations/sources/google-analytics-data-api
   externalDocumentationUrls:

airbyte-integrations/connectors/source-google-analytics-data-api/unit_tests/test_components.py

@@ -2,9 +2,11 @@
 # Copyright (c) 2025 Airbyte, Inc., all rights reserved.
 #
 
+from pathlib import Path
 from typing import Dict, List, Union
 
 import pytest
+import yaml
 
 
 _CONFIG = {
@@ -225,3 +227,28 @@ def test_not_expression_dimension_filter_config_transformation(components_module
     }
 
     assert config["custom_reports_array"][0]["dimensionFilter"] == expected_dimension_filter
+
+
+def test_complete_oauth_output_specification_contains_refresh_and_access_token():
+    """Verify that complete_oauth_output_specification declares both refresh_token and access_token,
+    and that extract_output matches.
+
+    Both tokens must be listed so the platform correctly merges the OAuth response into the
+    connector config when users create sources via the public API with secretId.
+
+    Regression test for https://github.com/airbytehq/oncall/issues/11935
+    """
+    manifest_path = Path(__file__).parent.parent / "manifest.yaml"
+    manifest = yaml.safe_load(manifest_path.read_text())
+
+    oauth_spec = manifest["spec"]["advanced_auth"]["oauth_config_specification"]
+
+    # extract_output should list both refresh_token and access_token
+    extract_output = oauth_spec["oauth_connector_input_specification"]["extract_output"]
+    assert "refresh_token" in extract_output, "refresh_token must be in extract_output"
+    assert "access_token" in extract_output, "access_token must be in extract_output"
+
+    # complete_oauth_output_specification must match extract_output
+    output_props = oauth_spec["complete_oauth_output_specification"]["properties"]
+    assert "refresh_token" in output_props, "refresh_token must be in complete_oauth_output_specification"
+    assert "access_token" in output_props, "access_token must be in complete_oauth_output_specification"

airbyte-integrations/connectors/source-google-search-console/manifest.yaml

@@ -232,6 +232,7 @@ spec:
         access_token_url: "https://oauth2.googleapis.com/token?{{client_id_param}}&{{client_secret_param}}&{{auth_code_param}}&{{redirect_uri_param}}&grant_type=authorization_code"
         extract_output:
           - refresh_token
+          - access_token
       complete_oauth_output_specification:
         type: object
         properties:

airbyte-integrations/connectors/source-google-search-console/metadata.yaml

@@ -10,7 +10,7 @@ data:
   connectorSubtype: api
   connectorType: source
   definitionId: eb4c9e00-db83-4d63-a386-39cfa91012a8
-  dockerImageTag: 1.10.30
+  dockerImageTag: 1.10.31
   dockerRepository: airbyte/source-google-search-console
   documentationUrl: https://docs.airbyte.com/integrations/sources/google-search-console
   externalDocumentationUrls:

airbyte-integrations/connectors/source-google-search-console/unit_tests/test_components.py

@@ -1,8 +1,10 @@
 # Copyright (c) 2025 Airbyte, Inc., all rights reserved.
 
 import logging
+from pathlib import Path
 
 import pytest
+import yaml
 
 
 @pytest.mark.parametrize(
@@ -205,3 +207,28 @@ def test_warning_logged_for_complex_values(self, components_module, caplog):
             component.transform(record=record)
 
         assert any("Complex value encountered for field 'clicks'" in msg for msg in caplog.messages)
+
+
+def test_complete_oauth_output_specification_contains_refresh_and_access_token():
+    """Verify that complete_oauth_output_specification declares both refresh_token and access_token,
+    and that extract_output matches.
+
+    Both tokens must be listed so the platform correctly merges the OAuth response into the
+    connector config when users create sources via the public API with secretId.
+
+    Regression test for https://github.com/airbytehq/oncall/issues/11935
+    """
+    manifest_path = Path(__file__).parent.parent / "manifest.yaml"
+    manifest = yaml.safe_load(manifest_path.read_text())
+
+    oauth_spec = manifest["spec"]["advanced_auth"]["oauth_config_specification"]
+
+    # extract_output should list both refresh_token and access_token
+    extract_output = oauth_spec["oauth_connector_input_specification"]["extract_output"]
+    assert "refresh_token" in extract_output, "refresh_token must be in extract_output"
+    assert "access_token" in extract_output, "access_token must be in extract_output"
+
+    # complete_oauth_output_specification must match extract_output
+    output_props = oauth_spec["complete_oauth_output_specification"]["properties"]
+    assert "refresh_token" in output_props, "refresh_token must be in complete_oauth_output_specification"
+    assert "access_token" in output_props, "access_token must be in complete_oauth_output_specification"

docs/integrations/sources/google-analytics-data-api.md

@@ -280,6 +280,7 @@ The Google Analytics connector is subject to Google Analytics Data API quotas. P
 
 | Version        | Date       | Pull Request                                             | Subject                                                                                                                                                                |
 |:---------------|:-----------|:---------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 2.9.30 | 2026-04-09 | [76190](https://github.com/airbytehq/airbyte/pull/76190) | Add access_token to extract_output and complete_oauth_output_specification to fix OAuth secretId 422 regression |
 | 2.9.29 | 2026-04-01 | [75580](https://github.com/airbytehq/airbyte/pull/75580) | Add `oauth_connector_input_specification` with granular scopes |
 | 2.9.28 | 2026-03-31 | [75678](https://github.com/airbytehq/airbyte/pull/75678) | Update dependencies |
 | 2.9.27 | 2026-03-24 | [74568](https://github.com/airbytehq/airbyte/pull/74568) | Update dependencies |

docs/integrations/sources/google-search-console.md

@@ -244,6 +244,7 @@ Google Search Console only retains data for websites from the last 16 months. An
 
 | Version     | Date       | Pull Request                                             | Subject                                                                                                                                                                |
 |:------------|:-----------|:---------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 1.10.31 | 2026-04-09 | [76190](https://github.com/airbytehq/airbyte/pull/76190) | Add access_token to extract_output and complete_oauth_output_specification to fix OAuth secretId 422 regression |
 | 1.10.30 | 2026-04-13 | [76276](https://github.com/airbytehq/airbyte/pull/76276) | Rename "concurrent workers" to "concurrent threads" in connector spec |
 | 1.10.29 | 2026-04-01 | [75582](https://github.com/airbytehq/airbyte/pull/75582) | Add `oauth_connector_input_specification` with granular scopes |
 | 1.10.28 | 2026-03-31 | [75699](https://github.com/airbytehq/airbyte/pull/75699) | Update dependencies |