rocketkind
Productivity

Google Workspace Admin

Google Workspace Admin is the control plane behind a Workspace account — users, groups, org units, admin roles, devices, domains and audit logs.

Authentication

  • OAuth 2.0

Actions

Generic API request. Call any Google Workspace Admin API endpoint on this connection, for the case where no shipped action covers it yet. The connection supplies the base URL, the authentication and the egress route, so only the path, query and body are yours to fill.

  • Act on mobile deviceDestructiveDestructive for two of its actions.
  • Add domainRegister an additional domain with the Google Workspace account so users and groups can be addressed on it.
  • Add domain aliasAttach an alias domain to an existing domain, so every mailbox on the parent also receives mail at the same local part on the alias — without creating any extra users.
  • Add group memberAdd someone to a group.
  • Add user aliasGive an account an extra email address that delivers to the same mailbox, without creating a second account or consuming a licence.
  • Assign admin roleDestructiveGrant an admin role to a user, group or service account.
  • Change ChromeOS device status (batch)DestructiveDestructive.
  • Check group membershipAsk whether one user belongs to a group and get back a single boolean.
  • Count ChromeOS devicesCount the enrolled ChromeOS devices matching a filter without paging through them — the cheap way to answer "how many Chromebooks are in this org unit", to size a fleet before a rollout, or to assert a threshold in a scheduled check.
  • Create admin roleDestructiveDefine a custom admin role from a set of privileges, so delegated administrators can be given exactly the access they need instead of a super-admin seat.
  • Create buildingRegister a site that calendar resources can be grouped under, so Calendar's room picker can offer rooms by building and floor.
  • Create calendar resourceCreate a bookable room or shared asset.
  • Create Chrome print serverRegister a print server so managed Chrome devices in an org unit can discover its queues instead of each printer being configured individually.
  • Create Chrome print servers in bulkDestructiveRegister up to 50 Chrome print servers in one call.
  • Create Chrome printerAdd a ChromeOS printer so managed Chrome devices can print to it.
  • Create Chrome printers in bulkDestructiveAdd up to 50 ChromeOS printers in one call — the practical way to roll out a floor or a site without 50 round trips.
  • Create custom user schemaDefine a new set of custom fields on user profiles — an employee id, a cost centre, a hire date — that user reads and writes then carry under customSchemas.<schemaName>.
  • Create data transferDestructiveHand a departing user's application data to a colleague — the offboarding step that moves Drive files, Calendar events and other per-application content before the account is suspended or deleted, so the work does not disappear with the person.
  • Create groupCreate a new Google group in the connected Workspace account.
  • Create group aliasGive a group an extra email address.
  • Create guest userCreate a guest account: an identity that can be given access to a limited subset of Workspace capabilities without consuming a full licensed seat.
  • Create organizational unitAdd an organizational unit under an existing parent, so users and devices can be filed under a policy boundary of their own.
  • Create room featureDefine a new room feature — an amenity label such as Whiteboard or Video call — so calendar resources can be tagged with it and people can filter on it in Calendar's room picker.
  • Create userProvision a new Google Workspace account.
  • Delete admin roleDestructiveDelete a custom admin role.
  • Delete buildingDestructiveDelete a building.
  • Delete calendar resourceDestructiveDelete a bookable room or asset.
  • Delete Chrome print serverDestructiveDelete one Chrome print server configuration.
  • Delete Chrome print servers in bulkDestructiveRemove up to 100 Chrome print server configurations in one call.
  • Delete Chrome printerDestructiveDelete one ChromeOS printer configuration.
  • Delete Chrome printers in bulkDestructiveRemove up to 100 ChromeOS printer configurations in one call.
  • Delete custom user schemaDestructiveDelete a custom user schema.
  • Delete groupDestructivePermanently delete a Google group together with its membership, its aliases and its archived conversations.
  • Delete group aliasDestructiveRemove one alternate email address from a group.
  • Delete mobile deviceDestructiveDestructive.
  • Delete organizational unitDestructiveRemove an organizational unit.
  • Delete room featureDestructiveDelete a room feature.
  • Delete userDestructiveDelete a Google Workspace account.
  • Generate backup verification codesIssue a fresh set of 2-Step Verification backup codes for an account, replacing any codes it already had - the previous set stops working the moment this succeeds, so never run it to "top up" codes someone is relying on.
  • Get admin roleRead one admin role and return the privileges it grants, plus whether it is one of Google's pre-defined system roles (which cannot be edited or deleted).
  • Get application-specific passwordRead one application-specific password entry: the label the person gave it, when they created it and when it was last used.
  • Get buildingRead one building and return its floor list, postal address and coordinates.
  • Get calendar resourceRead one bookable calendar resource: its capacity, where it sits (building, floor, section), the features attached to it, and — the part you usually want — the read-only resourceEmail that Calendar invitations must address.
  • Get Chrome print serverRead one Chrome print server configuration — its URI, description and the org unit that owns it.
  • Get Chrome printerRead one ChromeOS printer configuration: its URI, driver, owning org unit, and any output-only auxiliaryMessages telling you the configuration is invalid or no longer supported — which is the usual reason a printer stops appearing for users.
  • Get ChromeOS deviceRead one enrolled ChromeOS device by its device id — the detail lookup behind an asset audit, a compliance check, or a confirmation step after annotating or disabling a Chromebook.
  • Get ChromeOS device commandRead the status of a command previously queued on a ChromeOS device — the poll half of googleadmin:issuechromeosdevicecommand, which returns as soon as the command is accepted and tells you nothing about whether the device ran it.
  • Get custom user schemaRead one custom user schema and return its full field set — each field's programmatic name, type, whether it holds multiple values, and who is allowed to read it.
  • Get customer accountRead the Google Workspace account itself: its primary domain, default language, contact details and — most usefully — the concrete customer id that the literal mycustomer stands in for.
  • Get customer usage reportRead one day's account-wide usage and adoption statistics for the whole Workspace account — total licensed and active users, Gmail volume, Drive storage, Meet minutes, Chat and Calendar activity, and the security posture counters an admin reports on monthly.
  • Get data transferCheck on one data-transfer request by its id — the poll half of googleadmin:createdatatransfer, which returns as soon as the request is accepted rather than when the data has moved.
  • Get data transfer applicationRead one data-transfer application by its numeric id, chiefly to see the transferParams it accepts before building a transfer request.
  • Get domainRead one registered domain and return whether it is the primary domain, whether DNS ownership has been verified, and which aliases point at it.
  • Get domain aliasRead one domain alias: which domain it maps onto and whether its DNS ownership has been verified.
  • Get entity usage reportRead one day's usage statistics for objects rather than people or the account as a whole — the Admin SDK calls these entities, and the only entity type it currently reports on is Currents communities.
  • Get groupRead one Google Workspace group's properties — display name, description, member count and the alias addresses that deliver to it.
  • Get group memberRead one membership row: what role a person or nested group holds in a group, whether the membership is active or pending, and which delivery preference is set.
  • Get group settingsRead the posting, membership, moderation and archiving policy of one Google Group.
  • Get mobile deviceRead one synced mobile device by its resourceId — the detail lookup behind an approval decision, a compromised-device investigation, or a compliance check before granting access.
  • Get organizational unitRead one organizational unit and return its full OrgUnit resource — name, description, parent path and the immutable orgUnitId.
  • Get role assignmentRead one admin role grant: which role, which principal, and whether it applies account-wide or only inside one org unit.
  • Get room featureRead one room feature.
  • Get third-party app tokenRead one third-party application's OAuth grant on an account, including the exact scope list it holds.
  • Get userRead one Google Workspace account in full — profile, org unit, admin flags, 2-Step Verification state, aliases and, with projection full or custom, its custom-schema values.
  • Get user photoRead an account's profile thumbnail, returned as web-safe base64 image bytes together with its MIME type and pixel dimensions.
  • Get user usage reportRead one day's per-user usage statistics — last login time, whether 2-step verification is on, Gmail and Drive activity, Meet and Chat participation, and the account-status counters that answer "who has not signed in for 90 days" or "which accounts are still without 2SV".
  • Invalidate backup verification codesDestructiveVoid every 2-Step Verification backup code the account currently holds, without issuing new ones.
  • Issue ChromeOS device commandDestructiveDestructive for some command types.
  • List admin audit activitiesRead the Google Workspace audit log — this is how you answer "who did what, when, and from where".
  • List admin privilegesList every admin privilege a Google Workspace account can grant, as the tree the Admin console shows: each entry names a service (serviceId plus a readable serviceName) and a privilegeName, and carries its finer-grained childPrivileges.
  • List admin rolesList the admin roles defined for a Google Workspace account — both Google's pre-defined system roles and the custom ones an administrator created.
  • List application-specific passwordsList the application-specific passwords (ASPs) an account has generated.
  • List backup verification codesRead the account's current set of unused 2-Step Verification backup codes.
  • List buildingsList the buildings registered for a Google Workspace account — the sites that calendar resources are grouped under, each carrying its floor list and postal address.
  • List calendar resourcesList the bookable calendar resources of a Google Workspace account — meeting rooms and other shared assets, each with the read-only resourceEmail that people invite to a meeting.
  • List Chrome print serversList the Chrome print server configurations of a Google Workspace account — the CUPS-style servers whose queues managed devices discover, as distinct from individually configured printers.
  • List Chrome printersList the ChromeOS printer configurations of a Google Workspace account.
  • List ChromeOS devicesInventory the ChromeOS devices enrolled in the connected Google Workspace account — use it to find a device before annotating, disabling, deprovisioning or rebooting it, or to audit which Chromebooks sit in an org unit.
  • List custom user schemasList the custom user schemas defined for a Google Workspace account — the extra profile fields (employee id, cost centre, hire date) an administrator added on top of Google's own user attributes.
  • List data transfer applicationsList the applications whose user data can be handed from one account to another — Drive and Docs, Calendar, Google+ and whatever else is installed for this Workspace account.
  • List data transfersList the data-transfer requests raised in this account — the ownership hand-overs that move a departing employee's Drive files, Calendar events and other application data to a colleague.
  • List domain aliasesList the domain aliases of a Google Workspace account — alternate domains that deliver to mailboxes on a real domain without giving anyone a second account.
  • List domainsList every domain registered to a Google Workspace account — the primary domain, any secondary domains, and the aliases nested under each.
  • List group aliasesList the alternate email addresses that deliver to one group.
  • List group membersList who belongs to one group, a page at a time.
  • List groupsList the Google Workspace groups visible to the connected admin account, one page at a time.
  • List mobile devicesInventory the user-owned phones and tablets synced to the connected Google Workspace account — the starting point for approving a pending device, blocking a lost one, or auditing which handsets hold company mail.
  • List organizational unitsList the organizational units of a Google Workspace account — the tree users, devices and policies are filed under.
  • List role assignmentsList who holds which admin role in a Google Workspace account.
  • List room featuresList the room features defined for a Google Workspace account — the amenity labels (whiteboard, video call, accessible) that calendar resources are tagged with and that people filter on in Calendar's room picker.
  • List supported printer modelsList the printer models ChromeOS currently supports.
  • List third-party app tokensList the OAuth grants one account has given to third-party applications, with the scopes each application holds.
  • List user aliasesList every alternative email address that delivers to one account.
  • List usersPage through the Google Workspace accounts in an organization, optionally narrowed by a directory search.
  • Make user a super administratorDestructiveGrant or revoke the super administrator role on an account - the role that can do everything in the Workspace admin console, including creating and deleting other administrators.
  • Move ChromeOS devices to org unitDestructiveMove up to 50 enrolled ChromeOS devices into one organizational unit in a single call.
  • Patch admin roleDestructiveChange selected attributes of a custom admin role and leave the rest alone — the partial form, which is what you want to rename a role or edit its description without restating its privileges.
  • Patch buildingDestructiveChange selected attributes of a building and leave the rest alone — the partial form, for a rename or an added floor.
  • Patch calendar resourceDestructiveChange selected attributes of a bookable resource and leave the rest alone — the explicit partial form, for a capacity correction or a move to another floor.
  • Patch Chrome print serverDestructiveChange a Chrome print server's editable settings — display name, description, URI.
  • Patch Chrome printerDestructiveChange a ChromeOS printer's editable settings — display name, description, URI, driver.
  • Patch ChromeOS deviceDestructiveChange the admin-editable annotations on one ChromeOS device — who it is assigned to, where it lives, its asset tag, free-text notes, and the org unit it belongs to.
  • Patch custom user schemaDestructiveChange selected attributes of a custom user schema and leave the rest alone — the partial form, which is what you want to relabel a schema without restating its fields.
  • Patch customer accountDestructiveChange selected account-level settings and leave the rest alone — the partial form, which is what you want to correct a phone number or switch the default language without restating the postal address.
  • Patch groupDestructiveChange one or more of a group's editable properties, leaving everything else untouched.
  • Patch group memberDestructiveChange a membership's role or delivery preference, leaving the rest of it untouched.
  • Patch group settingsDestructiveChange one or more of a Google Group's policy settings — who may join, who may post, how messages are moderated, whether external members and web posting are allowed, whether the archive is on — leaving every setting you do not send exactly as it was.
  • Patch organizational unitDestructiveChange selected attributes of an organizational unit and leave the rest alone.
  • Patch room featureDestructiveChange selected attributes of a room feature and leave the rest alone.
  • Patch userDestructivePartially update a Google Workspace account: only the fields you send are changed and the rest are preserved.
  • Patch user photoDestructiveUpdate an account's profile thumbnail with patch semantics: only the photo fields you send are written.
  • Remove domainDestructiveRemove a secondary domain from the account.
  • Remove domain aliasDestructiveDetach a domain alias from the account.
  • Remove group memberDestructiveTake one member out of a group.
  • Remove user aliasDestructiveRemove one alternative email address from an account.
  • Remove user photoDestructiveRemove an account's profile thumbnail.
  • Rename room featureDestructiveRename a room feature, keeping it attached to every calendar resource already tagged with it — which is what makes this the supported way to change a feature's name, since the name is also its key.
  • Revoke application-specific passwordDestructiveRevoke one application-specific password.
  • Revoke role assignmentDestructiveRevoke one admin role grant, taking the privileges away from that principal immediately.
  • Revoke third-party app tokenDestructiveRevoke every access and refresh token one third-party application holds for an account, in a single call - there is no per-scope revocation.
  • Set user photoDestructiveReplace an account's profile thumbnail with an image you supply.
  • Sign user out everywhereDestructiveInvalidate every active web and device session for one account and reset its sign-in cookies, forcing the person to authenticate again everywhere.
  • Stop directory notification channelDestructiveCancel a Directory API push-notification channel, so Google stops POSTing user-change notifications to the endpoint that registered them.
  • Stop reports notification channelDestructiveCancel a Reports API push-notification channel, so Google stops POSTing audit-activity notifications to the endpoint googleadmin:watchactivities registered.
  • Turn off 2-Step VerificationDestructiveDisable 2-Step Verification on one account and unenrol whatever second factor it was using.
  • Undelete userDestructiveRestore a Google Workspace account that was deleted within the last 20 days, putting it back into an org unit of your choosing.
  • Update admin role (full replace)DestructiveReplace a custom admin role's definition.
  • Update building (full replace)DestructiveReplace a building's definition.
  • Update calendar resourceDestructiveUpdate a bookable resource.
  • Update ChromeOS deviceDestructiveReplace the admin-editable annotations on one ChromeOS device — assigned user, location, asset tag, notes and org unit — as a whole.
  • Update custom user schema (full replace)DestructiveReplace a custom user schema's definition.
  • Update customer account (full replace)DestructiveReplace the Google Workspace account's own settings — contact address, alternate email, phone number, default language.
  • Update group (replace)DestructiveReplace a group's editable properties wholesale.
  • Update group member (replace)DestructiveReplace a membership wholesale — the PUT half of the pair.
  • Update group settingsDestructiveWrite a Google Group's whole policy at once — who may join, who may post, how messages are moderated, whether external members and web posting are allowed, whether the archive is on.
  • Update organizational unit (full replace)DestructiveReplace an organizational unit's settings.
  • Update room feature (full replace)DestructiveReplace a room feature's definition.
  • Update userDestructiveChange an existing Google Workspace account, and the update method Google recommends over patchuser.
  • Watch admin audit activitiesSubscribe an HTTPS endpoint of yours to one application's audit log, so Google POSTs a notification when new activity is recorded instead of you polling googleadmin:listactivities.
  • Watch user aliases for changesOpen a Google push notification channel so alias additions and removals on ONE account are POSTed to an HTTPS endpoint you already run, instead of you polling listuseraliases.
  • Watch users for changesOpen a Google push notification channel so changes to the user directory are POSTed to an HTTPS endpoint you already run, instead of you polling listusers.

Triggers

  • New audit activityStarts when a new record appears in the chosen Google Workspace audit log — a sign-in, an administrator change, a file share or an OAuth grant, depending on which application is watched.
  • New user createdStarts when an account is created for a new user in the connected Google Workspace directory.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.