canonical: https://jentic.com/apis/googleapis.com/admin # Google Admin SDK API The Admin SDK API gives Google Workspace administrators programmatic control over their domains. The Directory surface manages users, groups, group members, organisational units, role assignments, mobile devices, ChromeOS devices, building and resource calendars, and domain aliases. Companion surfaces (Reports and Data Transfer) provide audit and usage reports and orchestrate user-data hand-offs during offboarding. Workspace ops teams use it to automate joiner-mover-leaver workflows, enforce device policies, and feed identity data into downstream HR and security tooling. ## For AI agents Manage Google Workspace users, groups, organisational units, and devices through the Admin SDK Directory API so an agent can automate provisioning, deprovisioning, and device administration. ## Scope Does not handle Gmail message access, Drive file content, or Google Cloud IAM grants - use for Workspace directory, device, and role-assignment management only. ## Capabilities - Provision and deprovision Workspace user accounts, including aliases, photos, and password updates - Manage groups and group memberships, with support for nested groups and dynamic membership signals - Move users between organisational units to apply policies based on team or location - List and command ChromeOS and mobile devices, including remote wipe and OS update enforcement - Assign and revoke admin roles using the role-based access control surface - Read and update calendar resources, buildings, and features for room booking integrations - Watch user, group, and OU changes via push notifications to drive downstream automations ## Use cases ### Joiner-Mover-Leaver Automation An IT team automates the full Workspace lifecycle from a central HR signal. Users.insert provisions accounts, members.insert adds them to the right groups, users.update.orgUnitPath moves them between OUs, and users.update with suspended=true deprovisions on exit. Each step is idempotent so reruns recover gracefully when an HR webhook is delivered twice. Example prompt: Given an HR offboarding event for jane@example.com, set the user to suspended=true, remove from all groups, transfer Drive ownership to her manager, and revoke OAuth tokens. ### ChromeOS Fleet Management A school district manages thousands of ChromeOS devices through the Admin SDK. The chromeosdevices endpoints list devices, move them between OUs, and issue commands such as REMOTE_POWERWASH or DEVICE_FETCH_LOGS, letting central IT respond to lost devices and incident tickets without classroom visits. Example prompt: List ChromeOS devices in OU /Students that have not synced in 14 days, and issue a DEVICE_FETCH_LOGS command on each. ### Group Membership Audits A security team audits sensitive groups (such as billing-admins@example.com) every week. Groups.list and members.list enumerate group composition, and the team compares the result against an HR system of record to flag stale memberships and missing approvals. Example prompt: List all members of billing-admins@example.com, diff against the approved roster in HR, and emit a Slack message naming members that should be removed. ### Calendar Resource Provisioning A facilities team registers new meeting rooms and shared resources so they appear in Google Calendar. The resources.calendars and resources.buildings endpoints define each room's name, capacity, features, and parent building so users can book them directly from Calendar. Example prompt: Create a calendar resource 'Helsinki-Sauna' under building HEL with capacity 4, then add the feature 'sauna' and verify the resource appears in /admin/directory/v1/customer/my_customer/resources/calendars. ### AI Agent Workspace Operations An AI agent embedded in the IT helpdesk handles common Workspace tasks through Jentic. The agent processes tickets such as 'reset my colleague's password' or 'add me to the analytics group', calling the Admin SDK with scoped credentials and replying with the change confirmation. Example prompt: Given the ticket 'add bob@example.com to data-readers', call members.insert with groupKey=data-readers@example.com and email=bob@example.com, then reply with the new member ID. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /admin/directory/v1/users | List Workspace users in the customer domain | | POST | /admin/directory/v1/users | Create a new Workspace user | | GET | /admin/directory/v1/groups | List groups in the customer domain | | POST | /admin/directory/v1/groups/{groupKey}/members | Add a member to a group | | POST | /admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand | Issue a command (e.g., remote powerwash) to a ChromeOS device | ## Key resources - **Users** — Provision, update, suspend, and delete Workspace user accounts and aliases - **Groups and Members** — Create groups, manage memberships, and watch for group changes - **Organisational Units** — Manage the OU tree and move users between OUs to apply policies - **ChromeOS Devices** — List ChromeOS devices, issue commands, and move them between OUs - **Mobile Devices** — List and act on managed mobile devices including remote wipe - **Roles and Role Assignments** — Assign admin roles and read existing assignments - **Calendar Resources** — Manage buildings, rooms, and features available in Google Calendar ## Why Jentic - **Setup:** Wiring the Admin SDK API by hand means setting up Google OAuth 2.0 with domain-wide delegation, minting short-lived access tokens from a service-account key, and directing calls at the admin.googleapis.com host with the right directory scopes. Through Jentic you install once, import the Admin SDK API from the API Directory, store the OAuth credential once, and your agent calls it. - **Permission scoping:** The Admin SDK puts the group and customer ids in the URL path (/admin/directory/v1/groups/{groupKey}/members, /customer/{customerId}/devices/...), so a rule can pin your agent to one group or customer's directory. You choose the operations it may call, so write actions like creating users, adding members, or issuing a device command are not included unless you add them. - **Credential handling:** Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and exchanged for short-lived access tokens at execution time. The service-account key never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create a Google Workspace user' or 'add a member to a group', and Jentic returns the matching Admin SDK operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Cloud Identity API** — Newer Google API that supersedes Admin SDK for groups and memberships - **Groups Settings API** — Manage per-group settings such as who can post, view, or join - **Google Cloud IAM API** — Bind Workspace users and groups to GCP roles for cloud resources ## FAQ ### What authentication does the Admin SDK API use? It uses Google OAuth 2.0 with directory-specific scopes such as https://www.googleapis.com/auth/admin.directory.user and admin.directory.group. Most operations require a delegated credential bound to a super-admin in the Workspace domain, typically via a service account with domain-wide delegation. Jentic stores the credential in its encrypted vault and exchanges it for short-lived access tokens at request time. ### Can I create a user with a temporary password through the API? Yes. POST /admin/directory/v1/users accepts a password field and a changePasswordAtNextLogin boolean. Set changePasswordAtNextLogin=true so the user is forced to rotate the password on first login, which keeps the temporary password out of long-term storage. ### What are the rate limits for the Admin SDK Directory API? The default per-user, per-100-seconds quota is 1,500 queries, with a per-project default of 2,400 queries per minute. Bulk operations should use batch HTTP and exponential back-off - 429 responses include a Retry-After header that the client must honour. ### How do I provision a new Workspace user through Jentic? Run jentic search 'create google workspace user', load the users.insert operation, and execute it with the primaryEmail, name, and password fields. The agent receives the created user resource with its ID and aliases, ready to feed into a follow-up members.insert call to add the user to groups. ### Can I issue a remote wipe on a ChromeOS device through the API? Yes. POST /admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand accepts a commandType such as REMOTE_POWERWASH or WIPE_USERS. The response returns a commandId that you can poll on /commands/{commandId} for status until the device acknowledges. ### Can I limit what my agent is allowed to do with the Admin SDK API? Yes. Because you run your own self-hosted Jentic One, your rules decide which Admin SDK operations and credentials the agent may use, so read-only calls like listing users, groups, or ChromeOS devices can be allowed while write actions such as users.insert, members.insert, or issuing a device command are excluded unless you add them. Since the Admin SDK puts the group and customer ids in the URL path, such as /groups/{groupKey}/members and /customer/{customerId}/devices, you can also pin the agent to a single group or customer directory. The OAuth credential stays with your instance and is exchanged for short-lived tokens only when an allowed operation runs.