<!-- BusyBot node reference — https://busybot.net/tools/google-gsuite-admin/ -->

> Node: Google Workspace Admin (`google_gsuite_admin`) · Action · v1.0.0
> Category: Productivity · Credentials: googleGSuiteAdminOAuth2Api (`googleGSuiteAdminOAuth2Api`)
> Updated: 2026-08-16

# Google Workspace Admin

> Manage users, groups, and ChromeOS devices in a Google Workspace (formerly G Suite) domain via the Admin SDK Directory API.

## Overview

Manage users, groups, and ChromeOS devices in a Google Workspace (formerly G Suite) domain via the Admin SDK Directory API.

**Category:** Productivity  
**Tool Name:** `google_gsuite_admin`  
**Version:** 1.0.0

**Appearance:** Icon: `lucide-Wrench` | Color: `#4285F4`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **Google Workspace Admin OAuth2 API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/google-gsuite-admin-oauth2-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| ChromeOS Device | `chromeOsDevice` |
| Group | `group` |
| User | `user` |

### Operations

**User** (`user`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Add to Group | `addToGroup` | Add a user to a group. |
| Create | `create` | Create a new user in the domain. |
| Delete | `delete` | Delete a user. |
| Get | `get` | Retrieve a single user. |
| Get Many | `getAll` | Retrieve many users. |
| Remove From Group | `removeFromGroup` | Remove a user from a group. |
| Update | `update` | Update an existing user. |

**Group** (`group`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Create | `create` | Create a new group. |
| Delete | `delete` | Delete a group. |
| Get | `get` | Retrieve a single group. |
| Get Many | `getAll` | Retrieve many groups. |
| Update | `update` | Update an existing group. |

**ChromeOS Device** (`chromeOsDevice`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Change Status | `changeStatus` | Enable or disable a ChromeOS device. |
| Get | `get` | Retrieve a single ChromeOS device. |
| Get Many | `getAll` | Retrieve many ChromeOS devices. |
| Update | `update` | Update a ChromeOS device's properties. |

### Parameters

This node shows the same field list whatever you select — no field is hidden based on the resource or the operation, so `User: Add to Group`, `User: Create`, `User: Delete`, `User: Get`, `User: Get Many`, `User: Remove From Group`, `User: Update`, `Group: Create`, `Group: Delete`, `Group: Get`, `Group: Get Many`, `Group: Update`, `ChromeOS Device: Change Status`, `ChromeOS Device: Get`, `ChromeOS Device: Get Many` and `ChromeOS Device: Update` take no parameters of their own. Fill in the fields your combination uses; the rest are ignored. Where the same field name is listed more than once below, it is one stored value that is read differently depending on the resource you pick.

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Authentication | `options` | No | `oAuth2` | Authentication method to use. |
| | | | | Options: `oAuth2`, `serviceAccount` |
| Google Account (`credentialId`) | `credential` | No | — | Connect or select your Google account. _(shown when Authentication is `oAuth2`)_ |
| Service Account Email | `string` | Yes | — | The email address of the Google service account. _(shown when Authentication is `serviceAccount`)_ |
| Private Key | `string` | Yes | — | The private key from the service account JSON key file, including the BEGIN and END lines. _(shown when Authentication is `serviceAccount`)_ |
| User (`userId`) | `string` | Yes | — | User email address or unique ID. Used by `User: Get`, `Update`, `Delete`, `Add to Group` and `Remove From Group`. Supports expressions. |
| Group (`groupId`) | `string` | Yes | — | Group email address or unique ID. Used by `User: Add to Group` and `User: Remove From Group` as the target group. Supports expressions. |
| First Name | `string` | Yes | — | The new user's first name. Used by `User: Create`. |
| Last Name | `string` | Yes | — | The new user's last name. Used by `User: Create`. |
| Password | `string` | Yes | — | Minimum 8 characters, maximum 100 characters. Used by `User: Create`. |
| Username | `string` | Yes | — | The local part of the new user's primary email (before the @). Used by `User: Create`. |
| Domain | `string` | Yes | — | The domain for the new user's primary email address. Joined to Username to build the address. Used by `User: Create`. |
| Additional Fields (`additionalFields`) | `collection` | No | `{}` | Optional user properties sent with `User: Create`. |
| — Change Password at Next Login | `boolean` | No | `false` | Require the user to set a new password at first sign-in. |
| — Phones | `array` | No | `[]` | Array of phone objects: [{ type, value, primary }] |
| — Secondary Emails | `array` | No | `[]` | Array of email objects: [{ type, address }] |
| — Roles | `multiOptions` | No | `[]` | Admin roles to grant the new user. |
| | | | | Options: `directorySyncAdmin`, `groupsAdmin`, `groupsEditor`, `groupsReader`, `helpDeskAdmin`, `inventoryReportingAdmin`, `mobileAdmin`, `servicesAdmin`, `storageAdmin`, `superAdmin`, `userManagement` |
| — Custom Fields | `array` | No | `[]` | Array of { schemaName, fieldName, value } objects. |
| Output (`output`) | `options` | Yes | `simplified` | How much of each user record to return. |
| | | | | Options: `simplified` (a fixed subset of profile fields), `raw` (the record exactly as the API returns it), `select` (only the fields you pick) |
| Fields | `multiOptions` | No | `[]` | The user fields to request. Applied only when Output (`output`) is `select`. |
| | | | | Options: `creationTime`, `isAdmin`, `kind`, `lastLoginTime`, `name`, `primaryEmail`, `suspended` |
| Custom Fields (`projection`) | `options` | Yes | `basic` | How much custom-schema data to include in user results. |
| | | | | Options: `basic` (don't include custom schemas), `custom` (only the schemas you name), `full` (include all custom schemas) |
| Custom Schema Names or IDs (`customFieldMask`) | `multiOptions` | No | `[]` | Comma-separated schema names whose fields are fetched. Applied only when Custom Fields (`projection`) is `custom`. |
| Return All (`returnAll`) | `boolean` | No | `false` | Return every user rather than a single page. Used by `User: Get Many`. |
| Limit (`limit`) | `number` | No | `100` | Max number of results to return (1-500). Used by `User: Get Many` when Return All is off. |
| Filter (`filter`) | `collection` | No | `{}` | Narrows the users returned by `User: Get Many`. |
| — Customer | `string` | No | — | The customer account to search. Your own account is used when this is left empty. |
| — Domain | `string` | No | — | Restrict the search to a single domain. |
| — Query | `string` | No | — | Directory search query, for example `name:contact* email:contact*`. |
| — Show Deleted | `boolean` | No | `false` | Include deleted users in the results. |
| Sort (`sort`) | `fixedCollection` | No | `{}` | Ordering for `User: Get Many`. |
| — Order By | `options` | No | — | The user field to sort on. |
| | | | | Options: `email`, `familyName`, `givenName` |
| — Sort Order | `options` | No | `ASCENDING` | Sort direction. |
| | | | | Options: `ASCENDING`, `DESCENDING` |
| Update Fields (`updateFields`) | `collection` | No | `{}` | The user properties to change on `User: Update`. |
| — Change Password at Next Login | `boolean` | No | `false` | Require the user to set a new password at next sign-in. |
| — First Name | `string` | No | — | The user's first name. |
| — Last Name | `string` | No | — | The user's last name. |
| — Password | `string` | No | — | A new password for the account. |
| — Primary Email | `string` | No | — | A new primary email address for the account. |
| — Phones | `array` | No | `[]` | Array of phone objects: [{ type, value, primary }] |
| — Secondary Emails | `array` | No | `[]` | Array of email objects: [{ type, address }] |
| — Suspend | `boolean` | No | `false` | Suspend the account, blocking sign-in without deleting it. |
| — Roles | `multiOptions` | No | `[]` | Admin roles to grant the user. |
| | | | | Options: `directorySyncAdmin`, `groupsAdmin`, `groupsEditor`, `groupsReader`, `helpDeskAdmin`, `inventoryReportingAdmin`, `mobileAdmin`, `servicesAdmin`, `storageAdmin`, `superAdmin`, `userManagement` |
| — Custom Fields | `array` | No | `[]` | Array of { schemaName, fieldName, value } objects. |
| Group (`groupId`) | `string` | Yes | — | Group email address or unique ID. Used by `Group: Get`, `Group: Update` and `Group: Delete`. Supports expressions. |
| Group Name (`name`) | `string` | No | — | The group's display name. Used by `Group: Create`. |
| Group Email (`email`) | `string` | Yes | — | The group's email address. Used by `Group: Create`. |
| Additional Fields (`additionalFields`) | `collection` | No | `{}` | Optional group properties sent with `Group: Create`. |
| — Description | `string` | No | — | Free-text description of the group. |
| Return All (`returnAll`) | `boolean` | No | `false` | Return every group rather than a single page. Used by `Group: Get Many`. |
| Limit (`limit`) | `number` | No | `100` | Max number of results to return. Used by `Group: Get Many` when Return All is off. |
| Filter (`filter`) | `collection` | No | `{}` | Narrows the groups returned by `Group: Get Many`. |
| — Customer | `string` | No | — | The customer account to search. Your own account is used when this and User ID are both empty. |
| — Domain | `string` | No | — | Restrict the search to a single domain. |
| — Query | `string` | No | — | Group search query. It must read `name:<value>` or `email:<value>`. |
| — User ID | `string` | No | — | Email or ID of a user; returns groups they belong to. |
| Sort (`sort`) | `fixedCollection` | No | `{}` | Ordering for `Group: Get Many`. |
| — Order By | `options` | No | `email` | The group field to sort on. |
| | | | | Options: `email` |
| — Sort Order | `options` | No | `ASCENDING` | Sort direction. |
| | | | | Options: `ASCENDING`, `DESCENDING` |
| Update Fields (`updateFields`) | `collection` | No | `{}` | The group properties to change on `Group: Update`. |
| — Description | `string` | No | — | Free-text description of the group. |
| — Email | `string` | No | — | A new email address for the group. |
| — Name | `string` | No | — | A new display name for the group. |
| Device ID | `string` | Yes | — | The ChromeOS device's unique identifier. Used by `ChromeOS Device: Get`, `Update` and `Change Status`. Supports expressions. |
| Output (`projection`) | `options` | Yes | `basic` | How much detail to return for each device. |
| | | | | Options: `basic`, `full` |
| Return All (`returnAll`) | `boolean` | No | `false` | Return every device rather than a single page. Used by `ChromeOS Device: Get Many`. |
| Limit (`limit`) | `number` | No | `100` | Max number of results to return. Used by `ChromeOS Device: Get Many` when Return All is off. |
| Include Children | `boolean` | No | `false` | Include devices from child organizational units. |
| Filter (`filter`) | `collection` | No | `{}` | Narrows the devices returned by `ChromeOS Device: Get Many`. |
| — Organizational Unit Path | `string` | No | — | Return only devices in this organizational unit. |
| — Query | `string` | No | — | Device search query, for example `status:ACTIVE`. |
| Sort (`sort`) | `fixedCollection` | No | `{}` | Ordering for `ChromeOS Device: Get Many`. |
| — Order By | `options` | No | — | The device field to sort on. |
| | | | | Options: `annotatedLocation`, `annotatedUser`, `lastSync`, `notes`, `serialNumber`, `status` |
| — Sort Order | `options` | No | — | Sort direction. |
| | | | | Options: `ascending`, `descending` |
| Update Fields (`updateOptions`) | `collection` | No | `{}` | The device properties to change on `ChromeOS Device: Update`. |
| — Move to Organizational Unit Path | `string` | No | — | Move the device into this organizational unit. |
| — Annotated User | `string` | No | — | The person the device is assigned to. |
| — Annotated Location | `string` | No | — | Where the device is kept. |
| — Annotated Asset ID | `string` | No | — | Your own asset tag for the device. |
| — Notes | `string` | No | — | Administrative notes about the device. |
| Status | `options` | Yes | `reenable` | The status to apply on `ChromeOS Device: Change Status`. |
| | | | | Options: `reenable` (enable the device again), `disable` (disable the device) |

## Output Data

The API result becomes the output item's JSON. Unlike most connector nodes this one does **not** pass the incoming item's fields through and does not forward binary data — reference upstream values before this node, or re-attach them afterwards with a Merge or Edit Fields node.

`User: Get Many`, `Group: Get Many` and `ChromeOS Device: Get Many` fan out: they emit **one output item per record**. A listing that matches nothing emits no output item at all for that input item, so the branch goes quiet rather than producing an empty result. Every other operation emits exactly one output item per input item.

With error handling set to **continue**, a failed item is not dropped — it leaves through the `Output` port carrying `error`, `resource` and `operation` instead of a record. Check for `error` before treating an item as a result, or use **errorPort** to keep failures on their own branch.

| Resource: Operation | Output item JSON |
|---------------------|------------------|
| `User: Add to Group` | `added: true` |
| `User: Remove From Group` | `removed: true` |
| `User: Delete` | `deleted: true` |
| `User: Create`, `User: Update` | The user record returned by the API |
| `User: Get`, `User: Get Many` | With Output `simplified`: `kind`, `id`, `primaryEmail`, `name`, `isAdmin`, `lastLoginTime`, `creationTime`, `suspended`. With `raw` or `select`: the record as the API returns it |
| `Group: Create`, `Group: Get`, `Group: Update` | The group record returned by the API |
| `Group: Get Many` | One item per group record |
| `Group: Delete` | `success: true` |
| `ChromeOS Device: Get`, `ChromeOS Device: Update` | The device record returned by the API |
| `ChromeOS Device: Get Many` | One item per device record |
| `ChromeOS Device: Change Status` | `success: true` and `action`, echoing the status you applied |

Reference the result downstream by expression, e.g. `{{ $json.id }}`.

## Usage Examples

- Use Google Workspace Admin in a workflow to manage users, groups, and ChromeOS devices in a Google Workspace (formerly G Suite) domain via the Admin SDK Directory API

## Example Configuration

Create a new user in the domain:

```json
{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "username": "john.doe",
    "firstName": "John",
    "lastName": "Doe",
    "password": "SecurePass123!",
    "domain": "company.com",
    "additionalFields": {
      "changePasswordAtNextLogin": true,
      "phones": [{ "value": "+1-555-0123", "type": "work" }]
    }
  }
}
```

List users in one domain, sorted by email:

```json
{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "user",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filter": {
      "domain": "company.com",
      "query": "orgUnitPath=/Engineering"
    },
    "sort": {
      "sortRules": {
        "orderBy": "email",
        "sortOrder": "ASCENDING"
      }
    },
    "projection": "full",
    "output": "simplified"
  }
}
```

Create a group:

```json
{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "group",
    "operation": "create",
    "name": "Engineering Team",
    "email": "engineering@company.com",
    "additionalFields": {
      "description": "Main engineering collaboration group"
    }
  }
}
```

Re-assign a ChromeOS device and record where it lives:

```json
{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "chromeOsDevice",
    "operation": "update",
    "deviceId": "device123456",
    "updateOptions": {
      "orgUnitPath": "/Engineering/Hardware",
      "annotatedUser": "john.doe@company.com",
      "annotatedLocation": "Building A, Floor 2, Desk 15",
      "annotatedAssetId": "HWENG-001",
      "notes": "Assigned to new hire in hardware team"
    }
  }
}
```

Add a user to a group:

```json
{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "user",
    "operation": "addToGroup",
    "userId": "john.doe@company.com",
    "groupId": "engineering@company.com"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manage users, groups, and ChromeOS devices in a Google Workspace domain via the Admin SDK Directory API. Use when you need to create or update user accounts, manage group memberships, or administer ChromeOS devices. Returns user profiles, group details, or device information.

### Error Prevention

- Always specify `resource` first to determine available operations
- Ensure `userId`/`groupId`/`deviceId` are provided for non-create operations
- Use proper email formats for user and group identifiers
- Validate organizational unit paths start with "/"