canonical: https://jentic.com/apis/googleapis.com/licensing

# Google Enterprise License Manager API

The Enterprise License Manager API lets Google Workspace administrators assign, change, and revoke product licenses for users in a customer they manage. It exposes operations to insert a license assignment, get or update an assignment, list assignments by product or by product and SKU, and delete an assignment. The API is the programmatic equivalent of the Apps Admin licensing console and is essential for automating onboarding, role changes, and offboarding at scale.

## For AI agents

Assign, update, list, and revoke Google Workspace product licenses for users in a customer. Use for onboarding, offboarding, and bulk license operations.

## Scope

Does not create users, manage groups, change billing, or transfer Workspace data - use only to assign, change, list, or revoke product/SKU licenses for existing users.

## Capabilities

- Assign a Workspace product SKU license to a specific user
- List all license assignments under a product across all SKUs
- List license assignments for a specific product and SKU
- Retrieve the current license assignment for one user
- Reassign a user from one SKU to another with patch or update
- Remove a user's license when they leave the organization

## Use cases

### Automated user onboarding

When HR creates a new employee in the source system, an automation calls POST /apps/licensing/v1/product/{productId}/sku/{skuId}/user to assign the appropriate Workspace SKU. Combining this with the Admin SDK to provision the account gives a one-call onboarding flow that finishes before the employee's first day.

Example prompt: Call POST /apps/licensing/v1/product/Google-Apps/sku/Google-Apps-Business/user with body {"userId": "jane@example.com"} and confirm the response includes a productId and skuId.

### License audit and reclamation

License assignments that are not actively used cost money. By calling GET /apps/licensing/v1/product/{productId}/sku/{skuId}/users to list every assignee under a SKU and cross-referencing with last login data from the Admin SDK, an agent can identify and revoke unused licenses with DELETE on the per-user endpoint.

Example prompt: List users assigned to Google-Apps-Business and DELETE the license for any user whose last login is older than 90 days.

### SKU upgrade or downgrade

When a user's role changes - for example, a contractor becomes a full-time employee - their Workspace SKU often changes too. PATCH /apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId} updates the SKU in place, so the user keeps their data and inbox without dropping access.

Example prompt: Patch the assignment for user jane@example.com to change skuId from Google-Apps-Lite to Google-Apps-Business.

### Offboarding via Jentic

On termination an offboarding agent needs to revoke licenses across every Workspace product the user holds. Using Jentic the agent lists products, then calls DELETE on each /apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId} path with no need to learn Google's nested URL structure.

Example prompt: Run google_licensing_revoke for the leaving user across all products and confirm each DELETE returns 204.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /apps/licensing/v1/product/{productId}/sku/{skuId}/user | Assign a license for a product and SKU to a user |
| GET | /apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId} | Get a user's license assignment |
| PATCH | /apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId} | Patch a user's license assignment |
| PUT | /apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId} | Replace a user's license assignment |
| DELETE | /apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId} | Revoke a user's license |
| GET | /apps/licensing/v1/product/{productId}/sku/{skuId}/users | List license assignments for a product and SKU |
| GET | /apps/licensing/v1/product/{productId}/users | List license assignments across all SKUs of a product |

## Key resources

- **licenseAssignments** — Insert, get, patch, update, delete, and list product/SKU license assignments for Workspace users

## Why Jentic

- **Setup:** Wiring the Enterprise License Manager API by hand means configuring super-admin OAuth2 or a service account with domain-wide delegation, narrowing to the apps.licensing scope, refreshing tokens, and assembling its product, SKU, and user path segments yourself. Through Jentic you install once, import the Enterprise License Manager API from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** The product, SKU, and user ids travel in the URL path (/apps/licensing/v1/product/{productId}/sku/{skuId}/user/{userId}), so a rule can pin your agent to one product or SKU: it assigns and lists licenses for that SKU and nothing else. You choose the operations it may call, so a license revoke is not included unless you add it.
- **Credential handling:** Your super-admin OAuth or delegated service-account credential is stored once, encrypted, by your own Jentic One instance and injected at execution time as a short-lived apps.licensing access token. The underlying credential never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'assign a workspace license' or 'list users with a sku', and Jentic returns the matching v1 operation with its productId, skuId, and userId templates so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Admin SDK API** — Admin SDK provisions users and groups; License Manager assigns Workspace SKUs to those users
- **Cloud Identity API** — Cloud Identity manages identity, groups, and devices; License Manager handles Workspace SKU assignments
- **Okta API** — Okta orchestrates licensing across many SaaS apps via SCIM; License Manager handles Google Workspace specifically

## FAQ

### What authentication does the Enterprise License Manager API use?

OAuth 2.0 with the https://www.googleapis.com/auth/apps.licensing scope. Calls require a super-admin user or a service account with domain-wide delegation acting as a super-admin. Through Jentic the credentials are encrypted in the vault and the agent only sees a short-lived access token.

### Which Workspace products and SKUs does the API support?

The API supports Google Workspace, G Suite Business, G Suite Basic, Google Vault, and Google Drive storage SKUs. The productId and skuId values are documented in the licensing API reference and must be passed exactly as defined.

### What are the rate limits for the Enterprise License Manager API?

Google enforces a default of 600 read requests per minute and 240 write requests per minute per project. Bulk onboarding flows that exceed those limits should batch with exponential backoff on 429 responses.

### How do I assign a license through Jentic?

Run jentic search 'assign a google workspace license to a user' to find POST /apps/licensing/v1/product/{productId}/sku/{skuId}/user, jentic load to retrieve its parameters, then jentic execute with productId, skuId, and the body containing userId. The response includes the new assignment object.

### Can I list every user assigned to a specific SKU?

Yes. GET /apps/licensing/v1/product/{productId}/sku/{skuId}/users returns paginated assignments. The product-level GET /apps/licensing/v1/product/{productId}/users returns assignments across all SKUs of that product, which is useful for audits.

### Is the Enterprise License Manager API free?

The API itself is free; you only pay for the underlying Workspace SKUs that get assigned. Quota is set at the Google Cloud project level.

### Can I limit what my agent is allowed to do with the Enterprise License Manager API?

Yes. Because you self-host Jentic One, your own rules decide which of this API's operations the agent may call, so you can grant it assigning and listing licenses while withholding the DELETE revoke or the PATCH and PUT SKU changes. Since the productId, skuId, and userId all travel in the URL path, a rule can also pin the agent to a single product or SKU, letting it assign and list licenses for that SKU and nothing else. Your super-admin OAuth or delegated service-account credential stays with your instance and is injected only as a short-lived apps.licensing token at execution time, so the agent never sees the underlying secret.