canonical: https://jentic.com/apis/googleapis.com/chromemanagement

# Google Chrome Management API

The Chrome Management API gives Workspace and ChromeOS administrators programmatic access to managed-browser and ChromeOS device telemetry, app and extension inventories, version distribution, crash events, and printing reports. It is the read API behind the Chrome Management console - useful for building cross-cloud reporting, enforcing extension allowlists, or tracking devices reaching end-of-life. Most operations are scoped to a customer id and aggregate counts across the managed fleet.

## For AI agents

Read managed-browser and ChromeOS device telemetry, app and extension inventories, crash events, and printing reports for a Google Workspace customer.

## Scope

Does not apply Chrome policies, manage user accounts, or write device configuration - use for read-only Chrome and ChromeOS telemetry and inventory only.

## Capabilities

- Count Chrome browsers and devices that need administrator attention
- Aggregate Chrome version distribution across the managed fleet
- List installed apps and extensions and the users requesting them
- Fetch the devices and users requesting a specific Chrome extension
- Report on Chrome crash events grouped by reason or version
- Summarise managed printer usage by printer or user

## Use cases

### Extension Risk Inventory

Security teams enumerate every Chrome extension installed across the managed fleet, cross-reference against a risk feed, and act on high-risk extensions in policy. countInstalledApps and fetchUsersRequestingExtension provide the inventory and the user-level requests respectively, which feed into a periodic compliance report. Most teams refresh weekly into a warehouse.

Example prompt: Call /v1/{customer}/reports:countInstalledApps and return the top 25 extensions sorted by user count.

### Fleet Version and Crash Reporting

IT teams monitor Chrome version drift and crash trends across thousands of managed devices. countChromeVersions returns the version distribution and countChromeCrashEvents groups crashes by version and reason, so admins can detect regressions in a specific minor release before user reports come in. Reports are aggregate counts - no PII is required.

Example prompt: Call /v1/{customer}/reports:countChromeCrashEvents grouped by chrome_version for the last 14 days and return the top 5 versions by crash count.

### ChromeOS Device Lifecycle Planning

Procurement teams use countChromeDevicesReachingAutoExpirationDate to plan refresh cycles, identifying ChromeOS devices losing automatic updates within a chosen horizon. The API returns aggregated counts grouped by model and expiration date, which supports budget forecasting without exporting device-level CSVs from the admin console.

Example prompt: Call /v1/{customer}/reports:countChromeDevicesReachingAutoExpirationDate for devices expiring in the next 12 months and return counts by model.

### AI Agent IT Reporter via Jentic

An AI agent through Jentic builds an on-demand IT report - Chrome version drift, top crash signatures, devices reaching end-of-life, and the most-requested extensions - without the admin having to navigate the Chrome Management console. Jentic isolates the Workspace OAuth credentials and exposes the report endpoints as named tools.

Example prompt: Through Jentic, search chromemanagement_count_chrome_versions, load schema, and execute it for customer C0123 over the last 30 days.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1/{+customer}/reports:countChromeVersions | Count Chrome browsers by version |
| GET | /v1/{+customer}/reports:countChromeCrashEvents | Count Chrome crash events |
| GET | /v1/{+customer}/reports:countInstalledApps | Count installed apps and extensions |
| GET | /v1/{+customer}/apps:fetchUsersRequestingExtension | List users requesting a specific extension |
| GET | /v1/{+customer}/reports:countChromeDevicesReachingAutoExpirationDate | Count devices reaching auto-update expiration |
| GET | /v1/{+customer}/reports:countPrintJobsByPrinter | Summarise print jobs by managed printer |

## Key resources

- **Reports** — Aggregate counts for Chrome browsers, devices, versions, crashes, and print jobs
- **Apps** — List installed apps, count Chrome app requests, and identify devices and users requesting extensions
- **Telemetry** — Read managed-browser and ChromeOS telemetry events

## Why Jentic

- **Setup:** Wiring the Chrome Management API by hand means standing up Workspace OAuth with chrome.management scopes, refreshing scoped access tokens, and shaping the count and fetch report queries yourself. Through Jentic you install once, import the Chrome Management API from the API Directory, store the OAuth credentials once, and your agent calls it.
- **Permission scoping:** The API puts the customer in the URL path (/v1/{+customer}/reports:countChromeVersions), so a rule can pin your agent to one customer's Chrome and ChromeOS telemetry: it reads that customer's inventory and reports and nothing else. These endpoints are read-only, so the agent cannot change any device configuration even with access.
- **Credential handling:** Your Workspace OAuth credentials with chrome.management scopes are stored once, encrypted, by your own Jentic One instance and injected at execution time. The agent receives only short-lived access tokens and the refresh token never enters its prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list installed Chrome extensions across the fleet', and Jentic returns the matching reports operation with its parameter schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Chrome Policy API** — Apply Chrome policies to org units after the Management API surfaces what to fix.
- **Admin SDK** — Manage Workspace users, groups, org units, and broader directory state.
- **Android Management API** — Manages Android devices and policies rather than Chrome browsers and ChromeOS.

## FAQ

### What authentication does the Chrome Management API use?

It requires OAuth 2.0 with the chrome.management.reports.readonly or chrome.management.appdetails.readonly scopes on a Workspace super admin or delegated admin account. Through Jentic, the OAuth credential is stored encrypted in your Jentic One instance and the agent receives only short-lived scoped access tokens.

### Can I list every Chrome extension installed across our fleet?

Yes. Call /v1/{customer}/reports:countInstalledApps to get aggregate counts by extension and complement it with /v1/{customer}/apps:fetchUsersRequestingExtension to identify which users requested a specific extension.

### What are the rate limits for the Chrome Management API?

Google enforces a per-project per-minute quota of around 600 read requests and lower limits for fleet-wide aggregations. Use orderBy and pageSize to keep responses small and stay within quota when reporting across very large fleets.

### How do I report on Chrome crashes through Jentic?

Use the Jentic search query "count Chrome crash events" to discover the customers.reports.countChromeCrashEvents operation, load its schema, and execute it with the customer id and a time range. Run pip install jentic to get started.

### Does the API expose per-device crash details?

Counts are aggregated by version, browser channel, or OS for privacy reasons. Per-device crash detail is not exposed through this API - use the Chrome Management console or Telemetry events for richer drill-down.

### Is the Chrome Management API free?

It is included with Chrome Enterprise Upgrade and ChromeOS Enterprise licences. There is no per-call charge from Google for the report endpoints used by this API.

### Can I limit what my agent is allowed to do with the Google Chrome Management API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and the customer id sits in every path (for example /v1/{customer}/reports:countChromeVersions), so a rule can pin the agent to one customer's Chrome and ChromeOS telemetry and nothing else. Every operation here, from countInstalledApps and countChromeCrashEvents to fetchUsersRequestingExtension, is read-only, so even with access the agent can report on inventory, versions, and crashes but cannot change any device configuration. You can also allow only the specific report and app operations the agent needs and withhold the rest.