> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace Directory

> Reference for the Tracecat Google Workspace Directory integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Batch change ChromeOS device status

Action ID: `tools.google_directory.batch_change_chromeos_device_status`

Changes the status of a batch of ChromeOS devices.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos/batchChangeStatus](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos/batchChangeStatus)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="change_chrome_os_device_status_action" type="string" required>
  The action to take on the ChromeOS device in order to change its status. Acceptable values are `CHANGE_CHROME_OS_DEVICE_STATUS_ACTION_DEPROVISION` (deprovisions a ChromeOS device; if you have ChromeOS Flex devices, you must first deprovision them and then delete them), `CHANGE_CHROME_OS_DEVICE_STATUS_ACTION_DISABLE` (disables a ChromeOS device) and `CHANGE_CHROME_OS_DEVICE_STATUS_ACTION_REENABLE` (reenables a ChromeOS device to be used after being disabled).
</ParamField>

<ParamField path="device_ids" type="array[string]" required>
  List of the IDs of the ChromeOS devices to change. Maximum 50.
</ParamField>

<ParamField path="customer_id" type="string">
  Immutable ID of the Google Workspace account.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="deprovision_reason" type="string | null">
  The reason behind a device deprovision. Must be provided if `changeChromeOsDeviceStatusAction` is set to `CHANGE_CHROME_OS_DEVICE_STATUS_ACTION_DEPROVISION`. Otherwise, omit this field. Acceptable values are `DEPROVISION_REASON_SAME_MODEL_REPLACEMENT`, `DEPROVISION_REASON_DIFFERENT_MODEL_REPLACEMENT`, `DEPROVISION_REASON_RETIRING_DEVICE`, `DEPROVISION_REASON_UPGRADE_TRANSFER` and `DEPROVISION_REASON_NOT_REQUIRED`.

  Default: `null`.
</ParamField>

## Check group membership

Action ID: `tools.google_directory.has_member`

Checks whether the given user is a member of the group. Membership can be direct or nested, but if nested, the `memberKey` and `groupKey` must be entities in the same domain or an `Invalid input` error is returned.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/hasMember](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/hasMember)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

<ParamField path="member_key" type="string" required>
  Identifies the user member in the API request. The value can be the user's primary email address, alias, or unique ID.
</ParamField>

## Delete application-specific password

Action ID: `tools.google_directory.delete_asp`

Deletes an ASP issued by a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/asps/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/asps/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="code_id" type="integer" required>
  The unique ID of the ASP to be deleted.
</ParamField>

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Delete group

Action ID: `tools.google_directory.delete_group`

Deletes a group.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

## Delete member

Action ID: `tools.google_directory.delete_member`

Removes a member from a group.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

<ParamField path="member_key" type="string" required>
  Identifies the group member in the API request. A group member can be a user or another group. The value can be the member's (group or user) primary email address, alias, or unique ID.
</ParamField>

## Delete mobile device

Action ID: `tools.google_directory.delete_mobile_device`

Removes a mobile device.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="resource_id" type="string" required>
  The unique ID the API service uses to identify the mobile device.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Delete OAuth token

Action ID: `tools.google_directory.delete_token`

Deletes all access tokens issued by a user for an application, revoking that application's access to the user's data.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="client_id" type="string" required>
  The Client ID of the application the token is issued to.
</ParamField>

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Delete organizational unit

Action ID: `tools.google_directory.delete_orgunit`

Removes an organizational unit.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="org_unit_path" type="string" required>
  The full path of the organizational unit (minus the leading `/`) or its unique ID. For example, pass `corp/sales` rather than `/corp/sales`.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Delete role assignment

Action ID: `tools.google_directory.delete_role_assignment`

Deletes a role assignment.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="role_assignment_id" type="string" required>
  Immutable ID of the role assignment.
</ParamField>

<ParamField path="customer" type="string">
  Immutable ID of the Google Workspace account.

  Default: `"my_customer"`.
</ParamField>

## Delete user

Action ID: `tools.google_directory.delete_user`

Deletes a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/delete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/delete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Generate verification codes

Action ID: `tools.google_directory.generate_verification_codes`

Generates new backup verification codes for the user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/verificationCodes/generate](https://developers.google.com/workspace/admin/directory/reference/rest/v1/verificationCodes/generate)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Email or immutable ID of the user.
</ParamField>

## Get application-specific password

Action ID: `tools.google_directory.get_asp`

Gets information about an ASP issued by a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/asps/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/asps/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="code_id" type="integer" required>
  The unique ID of the ASP.
</ParamField>

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Get ChromeOS device

Action ID: `tools.google_directory.get_chromeos_device`

Retrieves a Chrome OS device's properties.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="device_id" type="string" required>
  The unique ID of the device. The `deviceId`s are returned in the response from the `chromeosdevices.list` method.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="projection" type="string | null">
  Determines whether the response contains the full list of properties or only a subset. Acceptable values are `BASIC` (includes only the basic metadata fields, e.g. `deviceId`, `serialNumber`, `status` and `user`) and `FULL` (includes all metadata fields).

  Default: `null`.
</ParamField>

## Get ChromeOS device command

Action ID: `tools.google_directory.get_chromeos_device_command`

Gets command data a specific command issued to the device.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos.commands/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos.commands/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="command_id" type="integer" required>
  Immutable. ID of Chrome OS Device Command.
</ParamField>

<ParamField path="device_id" type="string" required>
  Immutable. ID of Chrome OS Device.
</ParamField>

<ParamField path="customer_id" type="string">
  Immutable. ID of the Google Workspace account.

  Default: `"my_customer"`.
</ParamField>

## Get customer

Action ID: `tools.google_directory.get_customer`

Retrieves a customer.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/customers/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customers/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer_key" type="string">
  Id of the customer to be retrieved. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Get domain

Action ID: `tools.google_directory.get_domain`

Retrieves a domain of the customer.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="domain_name" type="string" required>
  Name of domain to be retrieved.
</ParamField>

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Get group

Action ID: `tools.google_directory.get_group`

Retrieves a group's properties.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

## Get member

Action ID: `tools.google_directory.get_member`

Retrieves a group member's properties.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

<ParamField path="member_key" type="string" required>
  Identifies the group member in the API request. A group member can be a user or another group. The value can be the member's (group or user) primary email address, alias, or unique ID.
</ParamField>

## Get mobile device

Action ID: `tools.google_directory.get_mobile_device`

Retrieves a mobile device's properties.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="resource_id" type="string" required>
  The unique ID the API service uses to identify the mobile device.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="projection" type="string | null">
  Restrict information returned to a set of selected fields. Acceptable values are `BASIC` (includes only the basic metadata fields, e.g. `deviceId`, `model`, `status`, `type` and `status`) and `FULL` (includes all metadata fields).

  Default: `null`.
</ParamField>

## Get OAuth token

Action ID: `tools.google_directory.get_token`

Gets information about an access token issued by a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="client_id" type="string" required>
  The Client ID of the application the token is issued to.
</ParamField>

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Get organizational unit

Action ID: `tools.google_directory.get_orgunit`

Retrieves an organizational unit.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="org_unit_path" type="string" required>
  The full path of the organizational unit (minus the leading `/`) or its unique ID. For example, pass `corp/sales` rather than `/corp/sales`.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Get role

Action ID: `tools.google_directory.get_role`

Retrieves a role.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="role_id" type="string" required>
  Immutable ID of the role.
</ParamField>

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Get role assignment

Action ID: `tools.google_directory.get_role_assignment`

Fetches a specific role assignment.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="role_assignment_id" type="string" required>
  Immutable ID of the role assignment.
</ParamField>

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Get user

Action ID: `tools.google_directory.get_user`

Retrieves a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/get](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/get)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

<ParamField path="custom_field_mask" type="string | null">
  A comma-separated list of schema names. All fields from these schemas are fetched. This should only be set when `projection=custom`.

  Default: `null`.
</ParamField>

<ParamField path="projection" type="string | null">
  What subset of fields to fetch for this user. Allowed values are `basic`, `custom`, and `full`.

  Default: `null`.
</ParamField>

<ParamField path="view_type" type="string | null">
  Whether to fetch the administrator-only or domain-wide public view of the user. Allowed values are `admin_view` and `domain_public`.

  Default: `null`.
</ParamField>

## Insert group

Action ID: `tools.google_directory.insert_group`

Creates a group.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/insert](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/insert)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  Group resource to create. See [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups) for the full field list. Writable fields: `email` (required), `name`, `description` (maximum length is 4,096 characters).
</ParamField>

## Insert member

Action ID: `tools.google_directory.insert_member`

Adds a user to the specified group.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/insert](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/insert)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="email" type="string" required>
  The member's email address. A member can be a user or another group. This property is required when adding a member to a group.
</ParamField>

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

<ParamField path="delivery_settings" type="string | null">
  Defines mail delivery preferences of member. Allowed values are `ALL_MAIL`, `DAILY`, `DIGEST`, `DISABLED`, and `NONE`.

  Default: `null`.
</ParamField>

<ParamField path="role" type="string | null">
  The member's role in a group. Allowed values are `OWNER`, `MANAGER`, and `MEMBER`.

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  The type of group member. Allowed values are `CUSTOMER`, `EXTERNAL`, `GROUP`, and `USER`.

  Default: `null`.
</ParamField>

## Insert organizational unit

Action ID: `tools.google_directory.insert_orgunit`

Adds an organizational unit.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/insert](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/insert)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  OrgUnit resource to create. See [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits) for the full field list. Writable fields: `name` (required), `parentOrgUnitPath` (required, unless `parentOrgUnitId` is set), `parentOrgUnitId`, `description`.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Insert role assignment

Action ID: `tools.google_directory.insert_role_assignment`

Creates a role assignment.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/insert](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/insert)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="assigned_to" type="string" required>
  The unique ID of the entity this role is assigned to - either the `userId` of a user, the `groupId` of a group, or the `uniqueId` of a service account.
</ParamField>

<ParamField path="role_id" type="string" required>
  The ID of the role that is assigned.
</ParamField>

<ParamField path="scope_type" type="string" required>
  The scope in which this role is assigned. Acceptable values are `CUSTOMER` and `ORG_UNIT`.
</ParamField>

<ParamField path="customer" type="string">
  Immutable ID of the Google Workspace account.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="org_unit_id" type="string | null">
  If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.

  Default: `null`.
</ParamField>

## Insert user

Action ID: `tools.google_directory.insert_user`

Creates a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/insert](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/insert)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  User resource to create. See [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users) for the full field list. Most-used fields: `primaryEmail` (required), `name.givenName` (required), `name.familyName` (required), `password` (required), `changePasswordAtNextLogin`, `orgUnitPath`, `suspended`.
</ParamField>

<ParamField path="resolve_conflict_account" type="boolean | null">
  Optional. If set to `true`, the option selected for handling unmanaged user accounts will apply. Default: `false`

  Default: `null`.
</ParamField>

## Invalidate verification codes

Action ID: `tools.google_directory.invalidate_verification_codes`

Invalidates the current backup verification codes for the user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/verificationCodes/invalidate](https://developers.google.com/workspace/admin/directory/reference/rest/v1/verificationCodes/invalidate)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Email or immutable ID of the user.
</ParamField>

## Issue ChromeOS device command

Action ID: `tools.google_directory.issue_chromeos_device_command`

Issues a command for the device to execute.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos/issueCommand](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos/issueCommand)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="command_type" type="string" required>
  The type of command. Acceptable values are `REBOOT`, `TAKE_A_SCREENSHOT`, `SET_VOLUME`, `WIPE_USERS`, `REMOTE_POWERWASH`, `DEVICE_START_CRD_SESSION`, `CAPTURE_LOGS`, `FETCH_CRD_AVAILABILITY_INFO` and `FETCH_SUPPORT_PACKET`.
</ParamField>

<ParamField path="device_id" type="string" required>
  Immutable. ID of Chrome OS Device.
</ParamField>

<ParamField path="customer_id" type="string">
  Immutable. ID of the Google Workspace account.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="payload" type="string | null">
  The payload for the command, provide it only if command supports it. The following commands support adding payload: `SET_VOLUME` (payload is a stringified JSON object in the form `&#123; "volume": 50 &#125;`, where the volume has to be an integer in the range \[0,100]); `DEVICE_START_CRD_SESSION` (payload is optionally a stringified JSON object in the form `&#123; "ackedUserPresence": true, "crdSessionType": string &#125;`); `REBOOT` (payload is a stringified JSON object in the form `&#123; "user_session_delay_seconds": 300 &#125;`, where the delay has to be an integer in the range \[0,300]); and `FETCH_SUPPORT_PACKET` (payload is optionally a stringified JSON object in the form `&#123;"supportPacketDetails":&#123;"issueCaseId": optional_support_case_id_string, "issueDescription": optional_issue_description_string, "requestedDataCollectors": []&#125;&#125;`).

  Default: `null`.
</ParamField>

## List application-specific passwords

Action ID: `tools.google_directory.list_asps`

Lists the ASPs issued by a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/asps/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/asps/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## List ChromeOS devices

Action ID: `tools.google_directory.list_chromeos_devices`

Retrieves a paginated list of Chrome OS devices within an account.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="include_child_orgunits" type="boolean | null">
  Return devices from all child orgunits, as well as the specified org unit. If this is set to true, `orgUnitPath` must be provided.

  Default: `null`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return. Value should not exceed 300.

  Default: `null`.
</ParamField>

<ParamField path="order_by" type="string | null">
  Device property to use for sorting results. Acceptable values are `ANNOTATED_LOCATION`, `ANNOTATED_USER`, `LAST_SYNC`, `NOTES`, `SERIAL_NUMBER` and `STATUS`; the API's discovery document declares the equivalent `annotatedLocation`, `annotatedUser`, `lastSync`, `notes`, `serialNumber` and `status`.

  Default: `null`.
</ParamField>

<ParamField path="org_unit_path" type="string | null">
  The full path of the organizational unit (minus the leading `/`) or its unique ID.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Used to request the next page of query results.

  Default: `null`.
</ParamField>

<ParamField path="projection" type="string | null">
  Determines whether the response contains the full list of properties or only a subset. Acceptable values are `BASIC` (includes only the basic metadata fields, e.g. `deviceId`, `serialNumber`, `status` and `user`) and `FULL` (includes all metadata fields).

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string in the format given at [https://developers.google.com/workspace/admin/directory/v1/list-query-operators](https://developers.google.com/workspace/admin/directory/v1/list-query-operators)

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Whether to return results in ascending or descending order. Must be used with the `orderBy` parameter. Acceptable values are `ASCENDING` and `DESCENDING`.

  Default: `null`.
</ParamField>

## List domains

Action ID: `tools.google_directory.list_domains`

Lists the domains of the customer.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## List groups

Action ID: `tools.google_directory.list_groups`

Retrieves all groups of a domain or of a user given a userKey (paginated).

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer" type="string | null">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`. Set this to null when scoping the request with `domain` or `user_key`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="domain" type="string | null">
  The domain name. Use this field to get groups from only one domain. To return all domains for a customer account, use the `customer` query parameter instead.

  Default: `null`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return. Max allowed value is 200.

  Default: `null`.
</ParamField>

<ParamField path="order_by" type="string | null">
  Column to use for sorting results. The only allowed value is `email`.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Token to specify next page in the list.

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Query string search. Contains one or more search clauses, each with a field, operator, and value. For complete documentation, go to [https://developers.google.com/workspace/admin/directory/v1/guides/search-groups](https://developers.google.com/workspace/admin/directory/v1/guides/search-groups).

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Whether to return results in ascending or descending order. Only of use when orderBy is also used. Allowed values are `ASCENDING` and `DESCENDING`.

  Default: `null`.
</ParamField>

<ParamField path="user_key" type="string | null">
  Email or immutable ID of the user if only those groups are to be listed, the given user is a member of. If it's an ID, it should match with the ID of the user object. Cannot be used with the `customer` parameter.

  Default: `null`.
</ParamField>

## List members

Action ID: `tools.google_directory.list_members`

Retrieves a paginated list of all members in a group. This method times out after 60 minutes.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

<ParamField path="include_derived_membership" type="boolean | null">
  Whether to list indirect memberships. Default: false.

  Default: `null`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return. Max allowed value is 200.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Token to specify next page in the list.

  Default: `null`.
</ParamField>

<ParamField path="roles" type="string | null">
  The `roles` query parameter allows you to retrieve group members by role. Allowed values are `OWNER`, `MANAGER`, and `MEMBER`.

  Default: `null`.
</ParamField>

## List mobile devices

Action ID: `tools.google_directory.list_mobile_devices`

Retrieves a paginated list of all user-owned mobile devices for an account.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return. Max allowed value is 100.

  Default: `null`.
</ParamField>

<ParamField path="order_by" type="string | null">
  Device property to use for sorting results. Acceptable values are `DEVICE_ID`, `EMAIL`, `LAST_SYNC`, `MODEL`, `NAME`, `OS`, `STATUS` and `TYPE`; the API's discovery document declares the equivalent `deviceId`, `email`, `lastSync`, `model`, `name`, `os`, `status` and `type`.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Token to specify next page in the list.

  Default: `null`.
</ParamField>

<ParamField path="projection" type="string | null">
  Restrict information returned to a set of selected fields. Acceptable values are `BASIC` (includes only the basic metadata fields, e.g. `deviceId`, `model`, `status`, `type` and `status`) and `FULL` (includes all metadata fields).

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string in the format given at [https://developers.google.com/workspace/admin/directory/v1/search-operators](https://developers.google.com/workspace/admin/directory/v1/search-operators)

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Whether to return results in ascending or descending order. Must be used with the `orderBy` parameter. Acceptable values are `ASCENDING` and `DESCENDING`.

  Default: `null`.
</ParamField>

## List OAuth tokens

Action ID: `tools.google_directory.list_tokens`

Returns the set of tokens specified user has issued to 3rd party applications.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## List organizational units

Action ID: `tools.google_directory.list_orgunits`

Retrieves a list of all organizational units for an account.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="org_unit_path" type="string | null">
  The full path to the organizational unit or its unique ID. Returns the children of the specified organizational unit.

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  Whether to return all sub-organizations or just immediate children. Allowed values are `all`, `children` (default), and `allIncludingParent`.

  Default: `null`.
</ParamField>

## List privileges

Action ID: `tools.google_directory.list_privileges`

Retrieves a paginated list of all privileges for a customer.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/privileges/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/privileges/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all privileges for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## List role assignments

Action ID: `tools.google_directory.list_role_assignments`

Fetches a paginated collection of all role assignments.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="include_indirect_role_assignments" type="boolean | null">
  When set to `true`, fetches indirect role assignments (i.e. role assignment via a group) as well as direct ones. Defaults to `false`. You must specify `userKey` or the indirect role assignments will not be included.

  Default: `null`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Token to specify the next page in the list.

  Default: `null`.
</ParamField>

<ParamField path="role_id" type="string | null">
  Immutable ID of a role. If included in the request, returns only role assignments containing this role ID.

  Default: `null`.
</ParamField>

<ParamField path="user_key" type="string | null">
  The primary email address, alias email address, or unique user or group ID. If included in the request, returns role assignments only for this user or group.

  Default: `null`.
</ParamField>

## List roles

Action ID: `tools.google_directory.list_roles`

Retrieves a paginated list of all the roles in a domain.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="customer" type="string">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Token to specify the next page in the list.

  Default: `null`.
</ParamField>

## List user aliases

Action ID: `tools.google_directory.list_user_aliases`

Lists all aliases for a user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users.aliases/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users.aliases/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## List users

Action ID: `tools.google_directory.list_users`

Retrieves a paginated list of either deleted users or all users in a domain.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="custom_field_mask" type="string | null">
  A comma-separated list of schema names. All fields from these schemas are fetched. This should only be set when `projection=custom`.

  Default: `null`.
</ParamField>

<ParamField path="customer" type="string | null">
  The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all users for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`. You must provide either the `customer` or the `domain` parameter; set this to null when scoping the request with `domain`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="domain" type="string | null">
  The domain name. Use this field to get users from only one domain. To return all domains for a customer account, use the `customer` query parameter instead.

  Default: `null`.
</ParamField>

<ParamField path="max_results" type="integer | null">
  Maximum number of results to return.

  Default: `null`.
</ParamField>

<ParamField path="order_by" type="string | null">
  Property to use for sorting results. Allowed values are `email`, `familyName`, and `givenName`.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Token to specify next page in the list. The page token is only valid for three days.

  Default: `null`.
</ParamField>

<ParamField path="projection" type="string | null">
  What subset of fields to fetch for this user. Allowed values are `basic`, `custom`, and `full`.

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Query string for searching user fields. For more information on constructing user queries, see [https://developers.google.com/workspace/admin/directory/v1/guides/search-users](https://developers.google.com/workspace/admin/directory/v1/guides/search-users).

  Default: `null`.
</ParamField>

<ParamField path="show_deleted" type="string | null">
  If set to `true`, retrieves the list of deleted users. (Default: `false`)

  Default: `null`.
</ParamField>

<ParamField path="sort_order" type="string | null">
  Whether to return results in ascending or descending order, ignoring case. Allowed values are `ASCENDING` and `DESCENDING`.

  Default: `null`.
</ParamField>

<ParamField path="view_type" type="string | null">
  Whether to fetch the administrator-only or domain-wide public view of the user. Allowed values are `admin_view` and `domain_public`.

  Default: `null`.
</ParamField>

## List verification codes

Action ID: `tools.google_directory.list_verification_codes`

Returns the current set of valid backup verification codes for the specified user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/verificationCodes/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/verificationCodes/list)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Make user admin

Action ID: `tools.google_directory.make_user_admin`

Makes a user a super administrator.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/makeAdmin](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/makeAdmin)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="status" type="boolean" required>
  Indicates the administrator status of the user.
</ParamField>

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Move ChromeOS devices to organizational unit

Action ID: `tools.google_directory.move_chromeos_devices_to_ou`

Moves or inserts multiple Chrome OS devices to an organizational unit. You can move up to 50 devices at once.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/moveDevicesToOu](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/moveDevicesToOu)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="device_ids" type="array[string]" required>
  Chrome OS devices to be moved to OU. You can move up to 50 devices at once.
</ParamField>

<ParamField path="org_unit_path" type="string" required>
  Full path of the target organizational unit or its ID.
</ParamField>

<ParamField path="customer_id" type="string">
  Immutable. ID of the Google Workspace account.

  Default: `"my_customer"`.
</ParamField>

## Patch ChromeOS device

Action ID: `tools.google_directory.patch_chromeos_device`

Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`, or `annotatedAssetId`. This method supports patch semantics.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/patch](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices/patch)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  ChromeOsDevice resource ([https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices#ChromeOsDevice](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices#ChromeOsDevice)). Updatable fields: `annotatedUser`, `annotatedLocation`, `annotatedAssetId`, `notes` and `orgUnitPath`.
</ParamField>

<ParamField path="device_id" type="string" required>
  The unique ID of the device. The `deviceId`s are returned in the response from the `chromeosdevices.list` method.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

<ParamField path="projection" type="string | null">
  Determines whether the response contains the full list of properties or only a subset. Acceptable values are `BASIC` (includes only the basic metadata fields, e.g. `deviceId`, `serialNumber`, `status` and `user`) and `FULL` (includes all metadata fields).

  Default: `null`.
</ParamField>

## Patch group

Action ID: `tools.google_directory.patch_group`

Updates a group's properties. This method supports patch semantics.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/patch](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups/patch)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  Group fields to update. See [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups) for the full field list. Writable fields: `email`, `name`, `description` (maximum length is 4,096 characters).
</ParamField>

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

## Patch member

Action ID: `tools.google_directory.patch_member`

Updates the membership properties of a user in the specified group. This method supports patch semantics.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/patch](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/patch)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="group_key" type="string" required>
  Identifies the group in the API request. The value can be the group's email address, group alias, or the unique group ID.
</ParamField>

<ParamField path="member_key" type="string" required>
  Identifies the group member in the API request. A group member can be a user or another group. The value can be the member's (group or user) primary email address, alias, or unique ID.
</ParamField>

<ParamField path="delivery_settings" type="string | null">
  Defines mail delivery preferences of member. Allowed values are `ALL_MAIL`, `DAILY`, `DIGEST`, `DISABLED`, and `NONE`.

  Default: `null`.
</ParamField>

<ParamField path="role" type="string | null">
  The member's role in a group. Allowed values are `OWNER`, `MANAGER`, and `MEMBER`.

  Default: `null`.
</ParamField>

## Patch organizational unit

Action ID: `tools.google_directory.patch_orgunit`

Updates an organizational unit. This method supports patch semantics.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/patch](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits/patch)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  OrgUnit fields to update. See [https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits](https://developers.google.com/workspace/admin/directory/reference/rest/v1/orgunits) for the full field list. Writable fields: `name`, `parentOrgUnitPath`, `parentOrgUnitId`, `description`.
</ParamField>

<ParamField path="org_unit_path" type="string" required>
  The full path of the organizational unit (minus the leading `/`) or its unique ID. For example, pass `corp/sales` rather than `/corp/sales`.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Patch user

Action ID: `tools.google_directory.patch_user`

Updates a user using patch semantics.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/patch](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/patch)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="body" type="object" required>
  User fields to update. See [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users) for the full field list. Most-used fields: `primaryEmail`, `name.givenName`, `name.familyName`, `password`, `changePasswordAtNextLogin`, `orgUnitPath`, `suspended`. This method is unable to clear fields that contain repeated objects (`addresses`, `phones`, etc).
</ParamField>

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Perform mobile device action

Action ID: `tools.google_directory.action_mobile_device`

Takes an action that affects a mobile device. For example, remotely wiping a device.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/action](https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices/action)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="action" type="string" required>
  The action to be performed on the device. Acceptable values are `admin_account_wipe`, `admin_remote_wipe`, `approve`, `block`, `cancel_remote_wipe_then_activate` and `cancel_remote_wipe_then_block`.
</ParamField>

<ParamField path="resource_id" type="string" required>
  The unique ID the API service uses to identify the mobile device.
</ParamField>

<ParamField path="customer_id" type="string">
  The unique ID for the customer's Google Workspace account. As an account administrator, you can also use the `my_customer` alias to represent your account's `customerId`.

  Default: `"my_customer"`.
</ParamField>

## Sign out user

Action ID: `tools.google_directory.sign_out_user`

Signs a user out of all web and device sessions and reset their sign-in cookies. User will have to sign in by authenticating again.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/signOut](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/signOut)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the target user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Turn off two-step verification

Action ID: `tools.google_directory.turn_off_two_step_verification`

Turns off 2-Step Verification for user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/twoStepVerification/turnOff](https://developers.google.com/workspace/admin/directory/reference/rest/v1/twoStepVerification/turnOff)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="user_key" type="string" required>
  Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
</ParamField>

## Undelete user

Action ID: `tools.google_directory.undelete_user`

Undeletes a deleted user.

Reference: [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/undelete](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users/undelete)

### Secrets

Optional secrets:

* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_USER_TOKEN`.
* `google_admin_oauth`: OAuth token `GOOGLE_ADMIN_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="org_unit_path" type="string" required>
  OrgUnit of User.
</ParamField>

<ParamField path="user_key" type="string" required>
  The immutable id of the user.
</ParamField>