Product
Jentic OSThe workplace. An in-house AI platform for every employeeJentic OneSafe access. Agents reach your systems without holding keysJentic AIRThe foundation. Gets your existing platforms ready for AI
Pricing
Developers

GET STARTED

API DirectoryBrowse 10,000+ APIs Ready For AI Agent IntegrationDocumentationGuides and API reference

TOOLS

API ScoringCheck your AI Readiness using our scorecardArazzo UIVisualize Arazzo Workflows As Interactive DocumentationArazzo EditorBuild And Edit Multi-Step API Workflows Visually

COMMUNITY

GitHubOpen source projects and examplesOpen StandardsBuilt on open specs. Never locked in.
Resources
Company
About UsOur mission and teamCareersJoin our teamContactGet in touch
Try it now
Jentic OSJentic OneJentic AIR
Pricing
API DirectoryDocumentationAPI ScoringArazzo UIArazzo EditorGitHubOpen Standards
Resources
About UsCareersContact
Try it now
JenticJentic
Products
  • Jentic OS
  • Jentic One
  • Jentic AIR
For Developers
  • API Directory
  • Documentation
  • GitHub
Company
  • About Jentic
  • Careers
  • Contact Us
  • Trust Centre
ISO/IEC 27001:2022 certification badge issued by Prescient SecurityISO/IEC 27001:2022 certification badge issued by Prescient Security

Information Security Management System

Certified to ISO/IEC 27001:2022 by Prescient Security

Terms & Conditions•Privacy Policy•
© 2026 Jentic Technology Ltd. All rights reserved.
Switch to light modeSwitch to dark mode

Install Jentic One Beta

Connect the Admin SDK API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Admin SDK API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

1

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fadmin" | sh
2

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fadmin" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Admin SDK API.

Provision and deprovision Workspace user accounts, including aliases, photos, and password updates

Manage groups and group memberships, with support for nested groups and dynamic membership signals

Move users between organisational units to apply policies based on team or location

List and command ChromeOS and mobile devices, including remote wipe and OS update enforcement

GET STARTED

Start building with Admin SDK API

Explore with Jentic One
View OpenAPI Document

Assign and revoke admin roles using the role-based access control surface

Read and update calendar resources, buildings, and features for room booking integrations

Watch user, group, and OU changes via push notifications to drive downstream automations

Use Cases

Patterns agents use Admin SDK API for, with concrete tasks.

★ Joiner-Mover-Leaver Automation

An IT team automates the full Workspace lifecycle from a central HR signal. Users.insert provisions accounts, members.insert adds them to the right groups, users.update.orgUnitPath moves them between OUs, and users.update with suspended=true deprovisions on exit. Each step is idempotent so reruns recover gracefully when an HR webhook is delivered twice.

Given an HR offboarding event for jane@example.com, set the user to suspended=true, remove from all groups, transfer Drive ownership to her manager, and revoke OAuth tokens.

ChromeOS Fleet Management

A school district manages thousands of ChromeOS devices through the Admin SDK. The chromeosdevices endpoints list devices, move them between OUs, and issue commands such as REMOTE_POWERWASH or DEVICE_FETCH_LOGS, letting central IT respond to lost devices and incident tickets without classroom visits.

List ChromeOS devices in OU /Students that have not synced in 14 days, and issue a DEVICE_FETCH_LOGS command on each.

Group Membership Audits

A security team audits sensitive groups (such as billing-admins@example.com) every week. Groups.list and members.list enumerate group composition, and the team compares the result against an HR system of record to flag stale memberships and missing approvals.

List all members of billing-admins@example.com, diff against the approved roster in HR, and emit a Slack message naming members that should be removed.

Calendar Resource Provisioning

A facilities team registers new meeting rooms and shared resources so they appear in Google Calendar. The resources.calendars and resources.buildings endpoints define each room's name, capacity, features, and parent building so users can book them directly from Calendar.

Create a calendar resource 'Helsinki-Sauna' under building HEL with capacity 4, then add the feature 'sauna' and verify the resource appears in /admin/directory/v1/customer/my_customer/resources/calendars.

AI Agent Workspace Operations

An AI agent embedded in the IT helpdesk handles common Workspace tasks through Jentic. The agent processes tickets such as 'reset my colleague's password' or 'add me to the analytics group', calling the Admin SDK with scoped credentials and replying with the change confirmation.

Given the ticket 'add bob@example.com to data-readers', call members.insert with groupKey=data-readers@example.com and email=bob@example.com, then reply with the new member ID.

Key Endpoints

123 endpoints — the admin sdk api gives google workspace administrators programmatic control over their domains.

METHOD

PATH

DESCRIPTION

GET

/admin/directory/v1/users

List Workspace users in the customer domain

POST

/admin/directory/v1/users

Create a new Workspace user

GET

/admin/directory/v1/groups

List groups in the customer domain

POST

/admin/directory/v1/groups/{groupKey}/members

Add a member to a group

POST

/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand

Issue a command (e.g., remote powerwash) to a ChromeOS device

GET

/admin/directory/v1/users

List Workspace users in the customer domain

POST

/admin/directory/v1/users

Create a new Workspace user

GET

/admin/directory/v1/groups

List groups in the customer domain

POST

/admin/directory/v1/groups/{groupKey}/members

Add a member to a group

POST

/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand

Issue a command (e.g., remote powerwash) to a ChromeOS device

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Admin SDK API by hand means setting up Google OAuth 2.0 with domain-wide delegation, minting short-lived access tokens from a service-account key, and directing calls at the admin.googleapis.com host with the right directory scopes. Through Jentic you install once, import the Admin SDK API from the API Directory, store the OAuth credential once, and your agent calls it.

Permission scoping

The Admin SDK puts the group and customer ids in the URL path (/admin/directory/v1/groups/{groupKey}/members, /customer/{customerId}/devices/...), so a rule can pin your agent to one group or customer's directory. You choose the operations it may call, so write actions like creating users, adding members, or issuing a device command are not included unless you add them.

Credential isolation

Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and exchanged for short-lived access tokens at execution time. The service-account key never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a Google Workspace user' or 'add a member to a group', and Jentic returns the matching Admin SDK operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Cloud Identity API

→

Newer Google API that supersedes Admin SDK for groups and memberships

Choose Cloud Identity for new builds that focus on group and membership lifecycle - the Admin SDK Directory remains the canonical surface for user, OU, device, and role-assignment operations.

Complementary

Groups Settings API

→

Manage per-group settings such as who can post, view, or join

Use Groups Settings alongside the Admin SDK to configure access controls on groups created via members.insert.

Complementary

Google Cloud IAM API

→

Bind Workspace users and groups to GCP roles for cloud resources

Use IAM after provisioning a Workspace user to grant them roles on Google Cloud projects.

FAQs

Specific to using Admin SDK API through Jentic.

What authentication does the Admin SDK API use?

It uses Google OAuth 2.0 with directory-specific scopes such as https://www.googleapis.com/auth/admin.directory.user and admin.directory.group. Most operations require a delegated credential bound to a super-admin in the Workspace domain, typically via a service account with domain-wide delegation. Jentic stores the credential in its encrypted vault and exchanges it for short-lived access tokens at request time.

Can I create a user with a temporary password through the API?

Yes. POST /admin/directory/v1/users accepts a password field and a changePasswordAtNextLogin boolean. Set changePasswordAtNextLogin=true so the user is forced to rotate the password on first login, which keeps the temporary password out of long-term storage.

What are the rate limits for the Admin SDK Directory API?

The default per-user, per-100-seconds quota is 1,500 queries, with a per-project default of 2,400 queries per minute. Bulk operations should use batch HTTP and exponential back-off - 429 responses include a Retry-After header that the client must honour.

How do I provision a new Workspace user through Jentic?

Run jentic search 'create google workspace user', load the users.insert operation, and execute it with the primaryEmail, name, and password fields. The agent receives the created user resource with its ID and aliases, ready to feed into a follow-up members.insert call to add the user to groups.

Can I issue a remote wipe on a ChromeOS device through the API?

Yes. POST /admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand accepts a commandType such as REMOTE_POWERWASH or WIPE_USERS. The response returns a commandId that you can poll on /commands/{commandId} for status until the device acknowledges.

Can I limit what my agent is allowed to do with the Admin SDK API?

Yes. Because you run your own self-hosted Jentic One, your rules decide which Admin SDK operations and credentials the agent may use, so read-only calls like listing users, groups, or ChromeOS devices can be allowed while write actions such as users.insert, members.insert, or issuing a device command are excluded unless you add them. Since the Admin SDK puts the group and customer ids in the URL path, such as /groups/{groupKey}/members and /customer/{customerId}/devices, you can also pin the agent to a single group or customer directory. The OAuth credential stays with your instance and is exchanged for short-lived tokens only when an allowed operation runs.

APIs / Identity Auth / Google / Admin SDK API
Admin SDK API logo

Google Admin SDK API

Browse all Google APIs
38
AI ReadinessNon-Ready (F)38/100
See full scorecard
Official vendor OpenAPI document · agent-readyIdentity AuthDirectory Servicesoauth2123 EndpointsREST

For Agents

Manage Google Workspace users, groups, organisational units, and devices through the Admin SDK Directory API so an agent can automate provisioning, deprovisioning, and device administration.

Use for: I need to create a new Workspace user with a temporary password, List all groups in the marketing organisational unit, Add a user to the engineering-leads@example.com group, Suspend a user account immediately when an offboarding ticket is filed

Not supported: Does not handle Gmail message access, Drive file content, or Google Cloud IAM grants - use for Workspace directory, device, and role-assignment management only.

The Admin SDK API gives Google Workspace administrators programmatic control over their domains. The Directory surface manages users, groups, group members, organisational units, role assignments, mobile devices, ChromeOS devices, building and resource calendars, and domain aliases. Companion surfaces (Reports and Data Transfer) provide audit and usage reports and orchestrate user-data hand-offs during offboarding. Workspace ops teams use it to automate joiner-mover-leaver workflows, enforce device policies, and feed identity data into downstream HR and security tooling.

Jentic One on GithubView OpenAPI Document

Jentic AI Readiness Score

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

A

Admin SDK API

- Non-Ready (F)
38/100
43
Foundational Compliance
56
Developer Experience & Jentic Compatibility
18
AI-Readiness & Agent Experience
78
Agent Usability
63
Security
63
AI Discoverability
Powered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
43

Foundational Compliance

Base layer of spec validity and structural soundness.

Grade: DSignals: 4
73%

Lint Results

Aggregated quality score from linter diagnostics, weighted by severity.

100%

Resolution Completeness

Percentage of `$ref` references that resolve successfully.

0%

Specification Validity

Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).

0%

Structural Integrity

Structural correctness score based on schema issues using logarithmic dampening.

56

Developer Experience & Jentic Compatibility

Clarity, completeness, and ingestion readiness for developers and tooling.

Grade: CSignals: 4
0%

Example Density

How richly the API is illustrated with examples.

100%

Example Validity

Percentage of examples that conform to their schemas.

25%

Response Coverage

Percentage of operations with complete response definitions (success, client error, server error).

100%

Tooling Readiness

Health of API ingestion, bundling, and resolution within Jentic pipelines.

18

AI-Readiness & Agent Experience

Semantic breadth, depth, and agent comprehension for AI systems.

Grade: FSignals: 4
70%

Description Coverage

Coverage of descriptions across API elements.

0%

Error Standardization

Coverage of RFC 9457 Problem Details for error responses.

0%

OperationId Quality

Coverage, uniqueness, and casing consistency of operationIds for AI inference.

0%

Summary Coverage

Coverage of summaries across operations/tags/info.

78

Agent Usability

Functional utility, complexity comfort, and AI orchestration readiness.

Grade: A-Signals: 1
78%

Complexity Comfort

Agent comfort level based on API operational and structural complexity.

63

Security

Trust, risk posture, and security compliance.

Grade: B-Signals: 1
62%

Authentication Strength

Average quality of security schemes based on authentication method strength (weakest link for OAuth2).

63

AI Discoverability

Findability, semantic richness, and reasoning readiness.

Grade: B-Signals: 1
62%

Descriptive Richness

Clarity and depth of descriptions across API elements.

View full reportHow the score is calculatedMore about the dimensions

Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

Score your own APIScoring CLI agent skill
npx @jentic/api-scorecard-cli score <openapi-url>