rocketkind
Productivity

Google Cloud Identity

Google Cloud Identity is the administrative API behind a Google Workspace or Cloud Identity organization: its groups and memberships, its enrolled devices, the SAML and OIDC providers people sign in through, and the policies applied to org units.

Authentication

  • OAuth 2.0

Actions

Generic API request. Call any Google Cloud Identity API endpoint on this connection, for the case where no shipped action covers it yet. The connection supplies the base URL, the authentication and the egress route, so only the path, query and body are yours to fill.

  • Add allowlisted domainAdd an external domain to the organization's allowlist, so the features that consult it treat that domain's users as trusted.
  • Add group memberAdd a member to a Cloud Identity group.
  • Add IdP credentialRegister the identity provider's signing certificate on a SAML profile, so Google will trust assertions signed with it.
  • Approve device userDestructiveLet a work account access corporate data on the device it registered from.
  • Block device userDestructiveCut a work account off from corporate data on one device while leaving the data in place.
  • Cancel device user wipeDestructiveCall off an account wipe that has been requested but not yet delivered to the device.
  • Cancel device wipeDestructiveCall off a device wipe that has been requested but not yet delivered.
  • Cancel user invitationDestructiveWithdraw an invitation that has already been emailed, so its link stops working and the account is no longer being asked to join.
  • Check transitive membershipAnswer one question — is this person a member of this group, directly or through any chain of nested groups — as a single boolean.
  • Check whether a user is invitableCheck, before sending anything, whether an address can actually receive a takeover invitation.
  • Create groupCreate a Cloud Identity group under a customer.
  • Create inbound SSO assignmentTurn a configured SSO profile into something that actually applies, by binding it to an org unit or a group.
  • Create OIDC SSO profileRegister an OpenID Connect identity provider so Google can accept sign-ins from it.
  • Create policyBind a setting to a scope, creating an admin-configurable policy.
  • Create SAML SSO profileRegister a SAML identity provider so Google can accept sign-ins from it.
  • Delete deviceDestructiveRemove a device from the Cloud Identity inventory along with every device user on it.
  • Delete device userDestructiveRemove the registration of one work account on a device, which also revokes that account's access to the device's data.
  • Delete groupDestructivePermanently delete a Cloud Identity group and every membership in it.
  • Delete IdP credentialDestructiveRemove a signing certificate from a SAML profile.
  • Delete inbound SSO assignmentDestructiveRemove a sign-in rule, so its org unit or group falls back to whatever rule applies next — another group assignment, the org-unit assignment above it, or the organization default.
  • Delete OIDC SSO profileDestructiveRemove an OIDC federation.
  • Delete policyDestructiveRemove an admin-configured policy, so the scope it covered falls back to whatever policy applies above it — the parent org unit's, or the organization default.
  • Delete SAML SSO profileDestructiveRemove a SAML federation and the IdP credentials under it.
  • Get allowlisted domainRead one allowlist entry by its resource name, returning the domain it covers.
  • Get deviceRead one enrolled device by resource name, returning its hardware identity (serial, model, manufacturer, IMEI or MEID), its OS and security-patch level, and the two state fields that drive access decisions: managementState, which says whether the device is approved, blocked or being wiped, and compromisedState,…
  • Get device client stateRead one partner's posture report for one device user — its compliance verdict, health score and the reason text behind it, plus the partner's own key/value attributes and the etag you must send back when updating it.
  • Get device userRead one device user — the registration of a single work account on a single device — returning the account's email, its management state (approved, blocked, awaiting approval, wiping or unenrolled), whether the account is flagged compromised and whether a screen lock password is set.
  • Get groupRead one Cloud Identity group by resource name, returning its group key (the email that addresses it), display name, description, parent customer, labels and — for a dynamic group — the membership query and its evaluation status.
  • Get group security settingsRead the member restriction that governs who may belong to a security group — the CEL rule itself plus its evaluation state, which tells you whether the members already in the group comply.
  • Get IdP credentialRead the metadata of one signing certificate on a SAML SSO profile: whether the key is RSA or DSA, its size in bits, and when it was last updated.
  • Get inbound SSO assignmentRead one sign-in rule: what it targets (exactly one of an org unit or a group), which SSO mode it applies, which profile that mode points at, and — for a group assignment — its rank against the other group rules.
  • Get membershipRead one membership by resource name, returning the member's entity key, its type (a membership can be a user, a service account, another group, a shared drive or a browser or ChromeOS device), the roles it holds and any expiry on the MEMBER role.
  • Get membership graphExplain why a member is in a group by returning every membership path that connects them, which is what you need when a direct lookup says "not a member" but access is still granted through nesting.
  • Get OIDC SSO profileRead one inbound OIDC federation: the issuer URI Google derives the provider's discovery document from, the OAuth client id Google authenticates with, and the redirect URIs Google generated, which have to be registered at the identity provider.
  • Get policyRead one policy: which setting it configures, the value it sets, and the org unit or group the CEL query resolves to.
  • Get SAML SSO profileRead one inbound SAML federation, returning both halves of the trust: idpConfig, which is what you configured about the identity provider (its entity id, sign-in URL, sign-out redirect and change-password URL), and spConfig, which Google generated for you and the IdP needs — the entity id and Assertion Consumer…
  • Get user invitationRead one invitation's state and how many reminder emails have gone out.
  • Import company-owned deviceRegister a company-owned device in the inventory ahead of anyone signing in on it, which is how a laptop or phone is pre-approved rather than waiting for enrolment.
  • List allowlisted domainsList the external domains the organization has allowlisted — the domains whose users are treated as trusted for the features that consult this list, such as external sharing controls.
  • List device client statesList the third-party posture reports attached to a device user.
  • List device usersList the work accounts registered on a device — a device user is one account's use of one device, and it is the thing that gets approved, blocked or account-wiped, rather than the device itself.
  • List devicesList or search the devices enrolled in the organization's Cloud Identity device inventory — the endpoint-management view, covering phones, laptops and desktops registered through Endpoint Verification or mobile management, and the source of the devices/{deviceid} names the wipe, block and delete actions take.
  • List group membershipsList who belongs to one Cloud Identity group, a page at a time, with each member's roles (MEMBER, MANAGER, OWNER) and any expiry set on them.
  • List groupsList the Cloud Identity groups that live directly under one customer or identity source, a page at a time.
  • List IdP credentialsList the signing certificates registered on a SAML SSO profile — the public keys Google uses to verify assertions from that identity provider.
  • List inbound SSO assignmentsList the rules that decide how each part of the organization signs in.
  • List OIDC SSO profilesList the inbound OIDC federations configured for the organization.
  • List policiesList the Cloud Identity policies in force for the organization — each one binds a single setting (a Gmail service status, a Drive sharing rule) to the org unit or group it applies to, so this is where you look to see what is configured for whom without opening the Admin console.
  • List SAML SSO profilesList the inbound SAML federations configured for the organization — each one describes a third-party identity provider (Okta, Entra ID, Ping) that may sign users in to Google.
  • List user invitationsList the invitations offered to unmanaged consumer accounts that share one of the organization's verified domains — people who signed up for a personal Google account with a company address and have not yet been brought under management.
  • Look up group resource nameTranslate a group's email address into the groups/{groupid} resource name that every other Cloud Identity call takes.
  • Look up membership resource nameTranslate a member's email address into the membership resource name that getmembership, deletemembership and modifymembershiproles take.
  • Look up my device usersResolve the device the caller is running on into device-user resource names, using an identifier the endpoint itself can read.
  • Modify membership rolesDestructivePromote or demote an existing member without removing and re-adding them.
  • Remove allowlisted domainDestructiveTake a domain off the allowlist, so its users stop being treated as trusted by the features that consult it.
  • Remove group memberDestructiveRemove a member from a group entirely.
  • Search direct groupsList the groups a member was added to explicitly, ignoring anything they inherit through nesting — the cheap counterpart to searchtransitivegroups, and the one to reach for when you are about to change a person's own memberships rather than audit their effective access.
  • Search groupsFind Cloud Identity groups across a customer with a CEL query, which is what you want when you do not already know a group's resource name.
  • Search transitive groupsAsk the opposite question to searchtransitivememberships: given a person, which groups do they end up in, including every group reached through nesting.
  • Search transitive membershipsExpand a group all the way down: every member reachable through nesting, not just the direct ones, each tagged DIRECT, INDIRECT or DIRECTANDINDIRECT so you can tell an inherited member from an explicit one.
  • Send user invitationEmail an unmanaged consumer account, asking its owner to let the organization take it over; accepting turns the personal account into a managed one and preserves its data.
  • Update device client stateDestructiveWrite your own posture verdict for a device user, which is how an external security tool feeds Context-Aware Access: complianceState and healthScore are assertions your integration makes, not values Google computes, and access rules can be written against them.
  • Update groupDestructiveChange a group's display name, description or labels, leaving everything you do not name in updateMask untouched.
  • Update group security settingsDestructiveSet the member restriction on a security group — a CEL rule limiting who may be a member, written over member.type (1 user, 2 service account, 3 group) and member.customerid, whose only supported value is groupCustomerId(), combined with ==, && and ||.
  • Update inbound SSO assignmentDestructiveChange an existing sign-in rule — switch its mode, point it at a different profile, or move it up the group priority order.
  • Update OIDC SSO profileDestructiveChange an existing OIDC federation — most often the client secret after a rotation at the provider, or the issuer URI after a tenant move.
  • Update policyDestructiveChange what an existing policy sets.
  • Update SAML SSO profileDestructiveChange an existing SAML federation — typically the sign-in URL or entity id after the IdP has been reconfigured, or the display name.
  • Wipe deviceDestructiveErase everything on a device — this is the whole-device factory reset, not the account-only wipe, so personal data on a BYOD phone goes with it; use wipedeviceuser when only the work account should be removed.
  • Wipe device user accountDestructiveRemove one work account and its data from a device, leaving everything else on the machine alone — the selective wipe for BYOD hardware, where a full wipedevice would also destroy the owner's personal photos and apps.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.