Skip to content

Reference google workspace admin tool

URL: https://mkdocs.justinsforge.com/memory/general/reference_google_workspace_admin_tool/

scripts/forge_google_workspace_admin.py, generalist wrapper over the Admin SDK Directory API + Groups Settings API. Auth reuses forge_google_user.user_token(account), never hand-rolls credentials (see [[reference_google_access]], [[reference_agent_integrations]]).

Accounts with admin scopes

Directory scopes are org-scoped: a token only manages users/groups inside its OWN Workspace. ADMIN_ACCOUNTS in forge_google_user.py = {business, gus}: - business = [email protected] (justinwieb.com org) - gus = [email protected] (SEPARATE Gus Workspace org; token in ~/.forge-secrets/google-oauth-gus.env, consented 2026-07-15)

Add a new admin org: append <name>: SECRETS_DIR/"google-oauth-<name>.env" to ACCOUNT_ENVS + add name to ADMIN_ACCOUNTS, then one-time consent as that org's super-admin: forge_google_user.py --auth-url --account <name> --login-hint <admin@domain>.

Commands (default --account gus)

list-users [--domain d]          # primaryEmail, isAdmin, aliases
list-groups [--domain d]
create-group <email> <name> [--desc ...]      # idempotent (409=ok)
add-member <group> <member> [--role MEMBER|MANAGER|OWNER]
list-members <group>
add-alias <user> <alias>
allow-external-post <group>      # whoCanPostMessage=ANYONE_CAN_POST, MODERATE_NONE

Gotchas

  • Fresh-group propagation lag: right after create-group, adding members by email 404s for a few seconds. Retry once; it settles.
  • Role groups that receive external transactional mail (SOSDirect, IRS, bank, Shopify) MUST run allow-external-post, or Google bounces outside senders (default = members-only posting).
  • Mutations are idempotent: re-running create/add on an existing resource prints "already exists (ok)", not an error.

Gus Workspace state (2026-07-15)

  • Users: justin@ (super-admin; aliases hi@, deals@, partnerships@, all route to Justin only), michael@ (regular user).
  • Group [email protected] created: justin=OWNER, michael=MEMBER, external posting open. Home for Gus The Bass LLC logins (SOSDirect/EIN/bank).