Google Groups Settings API
Browse all Google APIsOfficial vendor OpenAPI document · agent-readyProductivityCollaborationoauth23 EndpointsREST
For Agents
Read and update the posting, moderation, archive, and visibility settings of a Google Workspace group identified by its email address or unique ID.
Use for: Get the current settings of a Google Group, Lock down a Google Group so only members can post, Update whoCanJoin to invited only on a Workspace group, Set a custom footer on the engineering@example.com group
Not supported: Does not create groups, manage membership, or send mail - use for reading and updating the configuration of an existing Google Group only.
The Google Groups Settings API exposes the configuration surface of a Google Group: who can post, who can join, message moderation rules, archive policies, custom footers, and visibility. Workspace administrators (or owners of the group) can read and update the full settings document for a single group identified by its email or unique ID. The API is paired with the Admin SDK Directory and Cloud Identity Groups APIs, which manage group lifecycle and membership; Groups Settings only controls how an existing group behaves.
Install Jentic One Beta
Connect the Groups Settings API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Groups Settings API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fgroups-settings" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fgroups-settings" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Groups Settings API.
Retrieve the full settings document for a Google Group, including posting permissions and moderation rules
Update a group's whoCanPostMessage and whoCanJoin policies in a single PUT or PATCH call
Configure message moderation, spam handling, and footer text for a Workspace group
Toggle archive retention and external-member visibility on a per-group basis
Switch a group between announce-only, restricted, and public collaboration patterns by updating settings
Use Cases
Patterns agents use Groups Settings API for, with concrete tasks.
★ Standardise Permissions Across Distribution Lists
Workspace administrators use the Groups Settings API to apply a uniform permission template across hundreds of distribution lists during onboarding or after a security review. A script iterates the directory, calls PUT /{groupUniqueId} for each group, and sets whoCanPostMessage, whoCanJoin, and whoCanViewMembership to the approved values. This replaces hand-editing each group in the admin console and produces an auditable change log.
For every group in distribution-lists.csv, call PUT /{groupUniqueId} setting whoCanPostMessage to ALL_MEMBERS_CAN_POST and whoCanJoin to INVITED_CAN_JOIN, then output a CSV with each group's success or failure.
Self-Service Announcement Group Provisioning
An IT portal lets internal teams request a new announce-only group; on approval, the portal creates the group in the Admin SDK and then calls PATCH /{groupUniqueId} on the Groups Settings API to apply the announce-only template (whoCanPostMessage = ALL_MANAGERS_CAN_POST, allowExternalMembers = false, archiveOnly = false). Teams get a correctly configured group without admin intervention.
Given groupId announcements-newhires@example.com, call PATCH /{groupUniqueId} to set whoCanPostMessage to ALL_MANAGERS_CAN_POST and allowExternalMembers to false, then GET the same group and confirm the values were applied.
AI Agent Group Audit and Remediation
An AI agent runs a security audit on Workspace groups by reading each group's settings via Jentic and flagging any that allow external posting or public viewing of membership. For groups outside policy the agent can either propose a remediation patch or apply it directly with admin approval. Jentic holds the OAuth credential and returns scoped tokens at call time so the agent never sees raw admin credentials.
For each group in the input list, GET /{groupUniqueId}, flag groups where allowExternalMembers is true or whoCanViewMembership is ALL_IN_DOMAIN_CAN_VIEW, and produce a remediation PATCH payload that tightens both fields to the secure default.
Key Endpoints
3 endpoints — the google groups settings api exposes the configuration surface of a google group: who can post, who can join, message moderation rules, archive policies, custom footers, and visibility.
METHOD
PATH
DESCRIPTION
GET
/{groupUniqueId}
Retrieve a group's full settings document
PUT
/{groupUniqueId}
Replace a group's settings with a full settings document
PATCH
/{groupUniqueId}
Update specific fields of a group's settings
GET
/{groupUniqueId}
Retrieve a group's full settings document
PUT
/{groupUniqueId}
Replace a group's settings with a full settings document
PATCH
/{groupUniqueId}
Update specific fields of a group's settings
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Groups Settings API by hand means configuring Workspace admin OAuth2, narrowing to the apps.groups.settings scope, refreshing tokens, and learning its group-id resource paths yourself. Through Jentic you install once, import the Groups Settings API from the API Directory, store the OAuth credential once, and your agent calls it.
Permission scoping
The group id travels in the URL path (/{groupUniqueId}), so a rule can pin your agent to one Google Group: it reads and updates that group's configuration and nothing else. You choose the operations it may call, so if you allow only GET the agent can read settings without ever changing them.
Credential isolation
Your Workspace admin OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time as a short-lived apps.groups.settings access token. The raw admin token never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'update google group settings' or 'read a group's configuration', and Jentic returns the GET, PUT, and PATCH operations on the group with their input schemas so the agent picks the right verb without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Groups Settings API through Jentic.
What authentication does the Groups Settings API use?
Google OAuth 2.0 with the apps.groups.settings scope, used by a Workspace administrator or the group owner. Through Jentic the OAuth credential is encrypted in the vault and exchanged for a short-lived access token only at the moment of the API call.
Can I update only one field of a group's settings?
Yes. PATCH /{groupUniqueId} accepts a partial settings document and updates only the fields you provide. Use PUT /{groupUniqueId} when you want to replace the full settings document.
What are the rate limits for the Groups Settings API?
Google enforces a per-project quota (default 1,000 queries per 100 seconds). Bulk updates across hundreds of groups should pace requests and back off on 429 responses.
How do I lock a group to members-only posting through Jentic?
Search Jentic with 'update google group settings', load the PATCH operation on /{groupUniqueId}, then execute with groupUniqueId as the group email and a body containing whoCanPostMessage set to ALL_MEMBERS_CAN_POST. Jentic handles OAuth scope and returns the updated settings document.
Does this API let me add or remove group members?
No. Membership is managed by the Admin SDK Directory API (members.insert / members.delete) or the Cloud Identity Groups API. Groups Settings only controls how an existing group behaves once members are present.
Can I limit what my agent is allowed to do with the Groups Settings API?
Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, so you can allow only GET on /{groupUniqueId} to let it read a group's settings without ever calling PUT or PATCH to change them. Since the group id travels in the URL path, a rule can also pin the agent to a single Google Group so it reads and updates that group's configuration and nothing else. The stored Workspace admin OAuth credential is injected only at call time as a short-lived apps.groups.settings token, so the agent never handles the raw credential.
GET STARTED