Reference · built on requestConnectorIdentity, IT & observability

Google Workspace

Users, groups, organizational units, roles, and managed devices in a Google Workspace domain through the Admin SDK Directory API.

Request accessPricing ↗

About

Google Workspace holds your domain's users, groups, organizational units, admin roles, and the Chrome OS and mobile devices enrolled to it. The Admin SDK Directory API at https://admin.googleapis.com exposes each as a REST resource: users, groups, members, orgunits, roles, roleAssignments, chromeosdevices, mobiledevices, domains, customers, and schemas. Push notifications through users.watch deliver add, delete, makeAdmin, undelete, and update events to an HTTPS address.

Through Fibric, an operator reads a user with its 2-Step Verification state, last login, and org unit, and proposes a suspension, a group change, or a device block. Approval is yours; the receipt lists each call and how to reverse it.

This is a reference listing. It documents what Fibric would read from Google Workspace and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Users through users.list and users.get, with suspended, archived, isAdmin, isEnrolledIn2Sv, isEnforcedIn2Sv, lastLoginTime, creationTime, and orgUnitPath
  • Groups, group aliases, and members through the groups, groups.aliases, and members resources
  • Organizational units through orgunits, and admin roles and their holders through roles, roleAssignments, and privileges
  • Chrome OS devices through chromeosdevices and mobile devices through mobiledevices, plus customer.devices.chromeos.commands
  • User change events add, delete, makeAdmin, undelete, and update through users.watch, marked by the X-Goog-Resource-State header
  • Domains, domain aliases, customers, schemas, and calendar resources through their own resources

Proposed actions

  • Target capability: propose a user update through PUT /admin/directory/v1/users/{userKey}, for example suspended, orgUnitPath, or changePasswordAtNextLogin
  • Target capability: propose a users.signOut call to end a user's sessions
  • Target capability: propose adding or removing a group member through the members resource
  • Target capability: propose a mobiledevices.action with approve, block, admin_account_wipe, or admin_remote_wipe

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Suspend a leaver and block their phone

    The operator proposes suspended true, a users.signOut, and a mobiledevices.action block for each device listed under the user. One approval covers the set; the receipt lists each call.

    With Offboarding Sweep

  • Finish onboarding without a spreadsheet

    A users.watch add event starts it. The operator reads orgUnitPath and proposes the group memberships that org unit normally carries, for the manager to approve.

    With Onboarding Checklist

  • Find accounts that stopped signing in

    lastLoginTime on each user gives the answer. The operator lists active users past your threshold and proposes suspensions, keeping isAdmin accounts for a separate review.

    With Stale Accounts

  • Close 2-Step Verification gaps

    isEnrolledIn2Sv and isEnforcedIn2Sv show who is enrolled and who is enforced. The operator drafts an org unit move or a reminder list for approval.

    With MFA Gaps

Requirements

  • A Google Workspace domain and a Super Admin to authorize the service account's client ID and scopes under API controls
  • A Google Cloud project with the Admin SDK API enabled and OAuth client or service account credentials
  • Read-only scopes such as admin.directory.user.readonly and admin.directory.group.readonly where the operator only reads
  • An HTTPS address with a valid SSL certificate, not self-signed, to receive users.watch notifications
Authentication
OAuth 2.0 with Admin SDK Directory scopes such as https://www.googleapis.com/auth/admin.directory.user, granted by an administrator's consent or to a service account with domain-wide delegation that a Super Admin authorizes in the Admin console.

Limits

  • Default quota is 2,400 queries per minute per user per Google Cloud project; 403 userRateLimitExceeded means back off exponentially
  • A per-account concurrent request limit returns 429 rateLimitExceeded and cannot be raised
  • User creation is limited to 10 per domain per second and org unit operations to 1 per customer per second
  • Notification channels do not renew themselves; call users.watch again before expiration, and users.list page tokens last three days

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Google Workspace ↗

Questions and answers

Does the Directory API send events?
Yes, for users. users.watch opens a web_hook channel to an HTTPS address for add, delete, makeAdmin, undelete, and update events. The address needs a valid certificate; self-signed and revoked certificates are rejected. Channels expire and must be replaced by calling watch again.
What can a service account do here?
With domain-wide delegation, a service account calls the API on behalf of users without individual consent. A Super Admin authorizes its client ID and OAuth scopes in the Admin console under API controls. Choose the narrowest scopes, for example admin.directory.user.readonly for read-only work.
How does the Directory API rate limit calls?
2,400 queries per minute per user per Google Cloud project by default, adjustable on the Admin SDK API Quotas page. A separate concurrent request limit per Google Workspace account returns 429 rateLimitExceeded and cannot be increased. User creation is capped at 10 per domain per second.
Ask about Google Workspace

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Google Workspace through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy