Google Workspace Admin

Category: IT / Identity
Connect by: Connect with OAuth
Official API docs: https://developers.google.com/admin-sdk/directory/reference/rest

What the agent can see

Capability	API call	Risk	Needs approval
List users in the Workspace account (customer=my_customer). (docs)	GET /users?customer=my_customer	🟢 low	— no
Get one user by primary email, alias, or unique user ID. (docs)	GET /users/{userKey}	🟢 low	— no
List groups in the Workspace account (customer=my_customer). (docs)	GET /groups?customer=my_customer	🟢 low	— no

What the agent can do

Capability	API call	Risk	Needs approval
Provision a new Workspace user (primaryEmail, given/family name, password). (docs)	POST /users	🔴 high	✅ yes
Suspend (or unsuspend) a user account by setting suspended on the user. (docs)	PUT /users/{userKey}	🔴 high	✅ yes
Add a member (by email) to a group, optionally with a role. (docs)	POST /groups/{groupKey}/members	🟡 medium	✅ yes

Connecting it

• You provide: Google Workspace super-admin account (OAuth)
• Where to get it: Google Cloud Console → enable the Admin SDK API → OAuth consent screen → Credentials → Create OAuth client ID. The connecting user MUST be a Google Workspace super-administrator; grant the admin.directory.user and admin.directory.group scopes at consent. Directory scopes are sensitive and require app verification for production.
• Permissions/scopes: https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.group

Account setup

• Account needed: A Google Workspace account; the connecting user must be a super-admin (or hold a custom admin role with the matching Directory privileges).
• App registration: Google Cloud project with the Admin SDK API enabled; OAuth client ID (Web application) with consent screen, authorized domains, redirect URIs.
• Verification required: admin.directory.* are SENSITIVE scopes: production use requires Google app verification (brand verification + scope justification). For server-to-server fleet automation, domain-wide delegation of a service account is the alternative — but THIS connector uses the interactive super-admin's OAuth token, so the token's account must itself hold super-admin privileges.
• Testing: Unverified 'Testing' apps are limited to listed test users; not shippable to production without verification.

Limits

Default 2,400 queries/min per user per Cloud project (HTTP 403 userRateLimitExceeded on exceed); account-wide concurrency caps return HTTP 429 rateLimitExceeded (per Workspace account, not raisable). User creation is capped at 10 users/domain/second. Use exponential backoff. Docs: https://developers.google.com/admin-sdk/directory/v1/limits