Google Workspace Admin integration

Overview

Manage users, groups, and ChromeOS devices in a Google Workspace (formerly G Suite) domain via the Admin SDK Directory API.

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires Google Workspace Admin OAuth2 API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
ChromeOS Device	chromeOsDevice
Group	group
User	user

Operations

User (user)

Operation	Value	Description
Add to Group	addToGroup	Add a user to a group.
Create	create	Create a new user in the domain.
Delete	delete	Delete a user.
Get	get	Retrieve a single user.
Get Many	getAll	Retrieve many users.
Remove From Group	removeFromGroup	Remove a user from a group.
Update	update	Update an existing user.

Group (group)

Operation	Value	Description
Create	create	Create a new group.
Delete	delete	Delete a group.
Get	get	Retrieve a single group.
Get Many	getAll	Retrieve many groups.
Update	update	Update an existing group.

ChromeOS Device (chromeOsDevice)

Operation	Value	Description
Change Status	changeStatus	Enable or disable a ChromeOS device.
Get	get	Retrieve a single ChromeOS device.
Get Many	getAll	Retrieve many ChromeOS devices.
Update	update	Update a ChromeOS device’s properties.

Parameters

Add to Group takes no parameters of its own — see All Operations. Create takes no parameters of its own — see All Operations. Delete takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Remove From Group takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Create takes no parameters of its own — see All Operations. Delete takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Change Status takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Add to Group takes no parameters of its own — see All Operations. Create takes no parameters of its own — see All Operations. Delete takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Remove From Group takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Create takes no parameters of its own — see All Operations. Delete takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Change Status takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Add to Group takes no parameters of its own — see All Operations. Create takes no parameters of its own — see All Operations. Delete takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Remove From Group takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Create takes no parameters of its own — see All Operations. Delete takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations. Change Status takes no parameters of its own — see All Operations. Get takes no parameters of its own — see All Operations. Get Many takes no parameters of its own — see All Operations. Update takes no parameters of its own — see All Operations.

All Operations

Parameter	Type	Required	Default	Description
Authentication	options	No	(current default)	Authentication method to use.
				Options: the authentication choices available to your workspace — pick one from the dropdown.
Google Account	credential	No	—	Connect or select your Google account. (shown when Authentication is oAuth2)
Service Account Email	string	Yes	—	The email address of the Google service account. (shown when Authentication is serviceAccount)
Private Key	string	Yes	—	The private key from the service account JSON key file. (shown when Authentication is serviceAccount)
User	string	Yes	—	User email address or unique ID
Group (groupId)	string	Yes	—	Group email address or unique ID
First Name	string	Yes	—
Last Name	string	Yes	—
Password	string	Yes	—	Minimum 8 characters, maximum 100 characters.
Username	string	Yes	—	The local part of the new user’s primary email (before the @).
Domain	string	Yes	—	The domain for the new user’s primary email address.
Additional Fields (additionalFields)	collection	No	{}
				Options: directorySyncAdmin
— Change Password at Next Login	boolean	No	false
— Phones	array	No	[]	Array of phone objects: [{ type, value, primary }]
— Secondary Emails	array	No	[]	Array of email objects: [{ type, address }]
— Roles	multiOptions	No	[]
				Options: directorySyncAdmin, groupsAdmin, groupsEditor, groupsReader, helpDeskAdmin, inventoryReportingAdmin, mobileAdmin, servicesAdmin, storageAdmin, superAdmin, userManagement
— Custom Fields	array	No	[]	Array of { schemaName, fieldName, value } objects.
Output (output)	options	Yes	simplified
				Options: simplified, raw, select
Fields	multiOptions	No	[]
				Options: creationTime, isAdmin, kind, lastLoginTime, name, primaryEmail, suspended
Custom Fields	options	Yes	basic	How much of the user record to return: ‘basic’ omits custom schema fields, ‘custom’ returns only the schemas named in Custom Schema Names or IDs, ‘full’ returns every field including all custom schemas.
				Options: basic, custom, full
Custom Schema Names or IDs	multiOptions	No	[]	Comma-separated schema names whose fields are fetched.
Return All (returnAll)	boolean	No	false
Limit (limit)	number	No	100	Max number of results to return (1-500).
Filter (filter)	collection	No	{}
— Customer	string	No	—
— Domain	string	No	—
— Query	string	No	—
— Show Deleted	boolean	No	false
Sort (sort)	fixedCollection	No	{}
				Options: email, annotatedLocation
— Order By	options	No	—
				Options: email, familyName, givenName
— Sort Order	options	No	ASCENDING
				Options: ASCENDING, DESCENDING
Update Fields (updateFields)	collection	No	{}
				Options: directorySyncAdmin
— Change Password at Next Login	boolean	No	false
— First Name	string	No	—
— Last Name	string	No	—
— Password	string	No	—
— Primary Email	string	No	—
— Phones	array	No	[]	Array of phone objects: [{ type, value, primary }]
— Secondary Emails	array	No	[]	Array of email objects: [{ type, address }]
— Suspend	boolean	No	false
— Roles	multiOptions	No	[]
				Options: directorySyncAdmin, groupsAdmin, groupsEditor, groupsReader, helpDeskAdmin, inventoryReportingAdmin, mobileAdmin, servicesAdmin, storageAdmin, superAdmin, userManagement
— Custom Fields	array	No	[]	Array of { schemaName, fieldName, value } objects.
Group (groupId)	string	Yes	—	Group email address or unique ID
Group Name	string	No	—
Group Email	string	Yes	—
Additional Fields (additionalFields)	collection	No	{}
				Options: directorySyncAdmin
— Description	string	No	—
Return All (returnAll)	boolean	No	false
Limit (limit)	number	No	100
Filter (filter)	collection	No	{}
— Customer	string	No	—
— Domain	string	No	—
— Query	string	No	—
— User ID	string	No	—	Email or ID of a user; returns groups they belong to.
Sort (sort)	fixedCollection	No	{}
				Options: email, annotatedLocation
— Order By	options	No	email
				Options: email
— Sort Order	options	No	ASCENDING
				Options: ASCENDING, DESCENDING
Update Fields (updateFields)	collection	No	{}
				Options: directorySyncAdmin
— Description	string	No	—
— Email	string	No	—
— Name	string	No	—
Device ID	string	Yes	—
Output (deviceProjection)	options	Yes	basic	How much of the ChromeOS device record to return: ‘basic’ returns the common identity and status fields, ‘full’ adds the detailed hardware, recent-users and activity reports. ChromeOS devices have no custom schemas.
				Options: basic, full
Return All (returnAll)	boolean	No	false
Limit (limit)	number	No	100
Include Children	boolean	No	false	Include devices from child organizational units.
Filter (filter)	collection	No	{}
— Organizational Unit Path	string	No	—
— Query	string	No	—
Sort (sort)	fixedCollection	No	{}
				Options: email, annotatedLocation
— Order By	options	No	—
				Options: annotatedLocation, annotatedUser, lastSync, notes, serialNumber, status
— Sort Order	options	No	—
				Options: ascending, descending
Update Fields (updateOptions)	collection	No	{}
— Move to Organizational Unit Path	string	No	—
— Annotated User	string	No	—
— Annotated Location	string	No	—
— Annotated Asset ID	string	No	—
— Notes	string	No	—
Status	options	Yes	reenable
				Options: reenable, disable

Output Data

The API result becomes the output item’s JSON. Unlike most connector nodes this one does not pass the incoming item’s fields through and does not forward binary data — reference upstream values before this node, or re-attach them afterwards with a Merge or Edit Fields node.

User: Get Many, Group: Get Many and ChromeOS Device: Get Many fan out: they emit one output item per record. A listing that matches nothing emits no output item at all for that input item, so the branch goes quiet rather than producing an empty result. Every other operation emits exactly one output item per input item.

With error handling set to continue, a failed item is not dropped — it leaves through the Output port carrying error, resource and operation instead of a record. Check for error before treating an item as a result, or use errorPort to keep failures on their own branch.

Resource: Operation	Output item JSON
User: Add to Group	added: true
User: Remove From Group	removed: true
User: Delete	deleted: true
User: Create, User: Update	The user record returned by the API
User: Get, User: Get Many	With Output simplified: kind, id, primaryEmail, name, isAdmin, lastLoginTime, creationTime, suspended. With raw or select: the record as the API returns it
Group: Create, Group: Get, Group: Update	The group record returned by the API
Group: Get Many	One item per group record
Group: Delete	success: true
ChromeOS Device: Get, ChromeOS Device: Update	The device record returned by the API
ChromeOS Device: Get Many	One item per device record
ChromeOS Device: Change Status	success: true and action, echoing the status you applied

Reference the result downstream by expression, e.g. {{ $json.id }}.

Example Configuration

Create a new user in the domain:

{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "username": "john.doe",
    "firstName": "John",
    "lastName": "Doe",
    "password": "SecurePass123!",
    "domain": "company.com",
    "additionalFields": {
      "changePasswordAtNextLogin": true,
      "phones": [{ "value": "+1-555-0123", "type": "work" }]
    }
  }
}

List users in one domain, sorted by email:

{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "user",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filter": {
      "domain": "company.com",
      "query": "orgUnitPath=/Engineering"
    },
    "sort": {
      "sortRules": {
        "orderBy": "email",
        "sortOrder": "ASCENDING"
      }
    },
    "projection": "full",
    "output": "simplified"
  }
}

Create a group:

{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "group",
    "operation": "create",
    "name": "Engineering Team",
    "email": "engineering@company.com",
    "additionalFields": {
      "description": "Main engineering collaboration group"
    }
  }
}

Re-assign a ChromeOS device and record where it lives:

{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "chromeOsDevice",
    "operation": "update",
    "deviceId": "device123456",
    "updateOptions": {
      "orgUnitPath": "/Engineering/Hardware",
      "annotatedUser": "john.doe@company.com",
      "annotatedLocation": "Building A, Floor 2, Desk 15",
      "annotatedAssetId": "HWENG-001",
      "notes": "Assigned to new hire in hardware team"
    }
  }
}

Add a user to a group:

{
  "type": "google_gsuite_admin",
  "parameters": {
    "resource": "user",
    "operation": "addToGroup",
    "userId": "john.doe@company.com",
    "groupId": "engineering@company.com"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage users, groups, and ChromeOS devices in a Google Workspace domain via the Admin SDK Directory API. Use when you need to create or update user accounts, manage group memberships, or administer ChromeOS devices. Returns user profiles, group details, or device information.

Error Prevention

• Always specify resource first to determine available operations
• Ensure userId/groupId/deviceId are provided for non-create operations
• Use proper email formats for user and group identifiers
• Validate organizational unit paths start with ”/”