canonical: https://jentic.com/apis/googleapis.com/groups-settings

# Google Groups Settings API

The Google Groups Settings API exposes the configuration surface of a Google Group: who can post, who can join, message moderation rules, archive policies, custom footers, and visibility. Workspace administrators (or owners of the group) can read and update the full settings document for a single group identified by its email or unique ID. The API is paired with the Admin SDK Directory and Cloud Identity Groups APIs, which manage group lifecycle and membership; Groups Settings only controls how an existing group behaves.

## For AI agents

Read and update the posting, moderation, archive, and visibility settings of a Google Workspace group identified by its email address or unique ID.

## Scope

Does not create groups, manage membership, or send mail - use for reading and updating the configuration of an existing Google Group only.

## Capabilities

- Retrieve the full settings document for a Google Group, including posting permissions and moderation rules
- Update a group's whoCanPostMessage and whoCanJoin policies in a single PUT or PATCH call
- Configure message moderation, spam handling, and footer text for a Workspace group
- Toggle archive retention and external-member visibility on a per-group basis
- Switch a group between announce-only, restricted, and public collaboration patterns by updating settings

## Use cases

### Standardise Permissions Across Distribution Lists

Workspace administrators use the Groups Settings API to apply a uniform permission template across hundreds of distribution lists during onboarding or after a security review. A script iterates the directory, calls PUT /{groupUniqueId} for each group, and sets whoCanPostMessage, whoCanJoin, and whoCanViewMembership to the approved values. This replaces hand-editing each group in the admin console and produces an auditable change log.

Example prompt: For every group in distribution-lists.csv, call PUT /{groupUniqueId} setting whoCanPostMessage to ALL_MEMBERS_CAN_POST and whoCanJoin to INVITED_CAN_JOIN, then output a CSV with each group's success or failure.

### Self-Service Announcement Group Provisioning

An IT portal lets internal teams request a new announce-only group; on approval, the portal creates the group in the Admin SDK and then calls PATCH /{groupUniqueId} on the Groups Settings API to apply the announce-only template (whoCanPostMessage = ALL_MANAGERS_CAN_POST, allowExternalMembers = false, archiveOnly = false). Teams get a correctly configured group without admin intervention.

Example prompt: Given groupId announcements-newhires@example.com, call PATCH /{groupUniqueId} to set whoCanPostMessage to ALL_MANAGERS_CAN_POST and allowExternalMembers to false, then GET the same group and confirm the values were applied.

### AI Agent Group Audit and Remediation

An AI agent runs a security audit on Workspace groups by reading each group's settings via Jentic and flagging any that allow external posting or public viewing of membership. For groups outside policy the agent can either propose a remediation patch or apply it directly with admin approval. Jentic holds the OAuth credential and returns scoped tokens at call time so the agent never sees raw admin credentials.

Example prompt: For each group in the input list, GET /{groupUniqueId}, flag groups where allowExternalMembers is true or whoCanViewMembership is ALL_IN_DOMAIN_CAN_VIEW, and produce a remediation PATCH payload that tightens both fields to the secure default.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /{groupUniqueId} | Retrieve a group's full settings document |
| PUT | /{groupUniqueId} | Replace a group's settings with a full settings document |
| PATCH | /{groupUniqueId} | Update specific fields of a group's settings |

## Key resources

- **Groups** — Read and update the settings document of a single Google Group

## Why Jentic

- **Setup:** Wiring the Groups Settings API by hand means configuring Workspace admin OAuth2, narrowing to the apps.groups.settings scope, refreshing tokens, and learning its group-id resource paths yourself. Through Jentic you install once, import the Groups Settings API from the API Directory, store the OAuth credential once, and your agent calls it.
- **Permission scoping:** The group id travels in the URL path (/{groupUniqueId}), so a rule can pin your agent to one Google Group: it reads and updates that group's configuration and nothing else. You choose the operations it may call, so if you allow only GET the agent can read settings without ever changing them.
- **Credential handling:** Your Workspace admin OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time as a short-lived apps.groups.settings access token. The raw admin token never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'update google group settings' or 'read a group's configuration', and Jentic returns the GET, PUT, and PATCH operations on the group with their input schemas so the agent picks the right verb without browsing the reference docs.

## Related APIs

- **Admin SDK Directory API** — Creates groups and manages membership; Groups Settings configures how those groups behave.
- **Cloud Identity API** — Cloud Identity Groups manages group lifecycle in modern Workspace tenants and overlaps with parts of Groups Settings.
- **Groups Migration API** — Imports historical mail into the same group archives whose policies Groups Settings configures.

## FAQ

### What authentication does the Groups Settings API use?

Google OAuth 2.0 with the apps.groups.settings scope, used by a Workspace administrator or the group owner. Through Jentic the OAuth credential is encrypted in the vault and exchanged for a short-lived access token only at the moment of the API call.

### Can I update only one field of a group's settings?

Yes. PATCH /{groupUniqueId} accepts a partial settings document and updates only the fields you provide. Use PUT /{groupUniqueId} when you want to replace the full settings document.

### What are the rate limits for the Groups Settings API?

Google enforces a per-project quota (default 1,000 queries per 100 seconds). Bulk updates across hundreds of groups should pace requests and back off on 429 responses.

### How do I lock a group to members-only posting through Jentic?

Search Jentic with 'update google group settings', load the PATCH operation on /{groupUniqueId}, then execute with groupUniqueId as the group email and a body containing whoCanPostMessage set to ALL_MEMBERS_CAN_POST. Jentic handles OAuth scope and returns the updated settings document.

### Does this API let me add or remove group members?

No. Membership is managed by the Admin SDK Directory API (members.insert / members.delete) or the Cloud Identity Groups API. Groups Settings only controls how an existing group behaves once members are present.

### Can I limit what my agent is allowed to do with the Groups Settings API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, so you can allow only GET on /{groupUniqueId} to let it read a group's settings without ever calling PUT or PATCH to change them. Since the group id travels in the URL path, a rule can also pin the agent to a single Google Group so it reads and updates that group's configuration and nothing else. The stored Workspace admin OAuth credential is injected only at call time as a short-lived apps.groups.settings token, so the agent never handles the raw credential.