Google Workspace
Read and manage a Google Workspace organization: users, groups, org units and the audit trail.
Connect a Google Workspace admin account to work the organization itself: search the directory and read a user's record, list groups and their members, walk org units and domains, manage group membership and roles, run the reversible user lifecycle (suspend or restore an account, move it between org units, invalidate its sessions), and read the login, admin and OAuth-grant audit trail. Acts with the connected admin's own privileges - it can do exactly what that account can. Does not create users, set passwords, delete accounts, or grant admin roles.
Connect
Sign in with Google. Sign in as a Workspace admin to read the directory, manage groups, and run the user lifecycle. An organization admin configures the OAuth app once under Integrations → OAuth apps; after that, connecting is a consent screen.
-
Connect with an account that holds the Workspace admin privileges you want Yekar.AI to have - every tool inherits that ceiling, and a non-admin account gets a permission error on the first call.
-
Because it acts on the whole organization, bind it as a domain (service) connection owned by an admin rather than expecting each user to connect their own.
-
The scopes cover reading the directory, group management, the reversible user lifecycle (suspend/restore, move org unit, sign out) and audit reads. Creating users, setting passwords, deleting accounts and granting admin roles are deliberately not included.
-
The Admin SDK API must be enabled on the Google Cloud project behind the OAuth client.
Tools
| Tool | Access | What it does |
|---|---|---|
Get organization profile (yekar.google-workspace.get-org-profile) | Read | Read the connected Google Workspace customer's own profile - customer id, primary domain, organization name. The cheapest way to confirm the connection works and to see WHICH Workspace it is pointed at before running anything else. |
List users (yekar.google-workspace.list-users) | Read | List the Workspace's users, optionally filtered by Directory search syntax or restricted to an org unit. Returns one page plus a nextCursor when more exist - the Admin SDK reports no total, so the count of returned rows is NOT the size of the directory. |
Get user (yekar.google-workspace.get-user) | Read | Read one user's directory record: name, suspension state and reason, org unit, admin flags, aliases, and last login. The tool to call before any lifecycle change, and the one that answers 'is this account still active'. |
List groups (yekar.google-workspace.list-groups) | Read | List the Workspace's groups - all of them, those on one domain, or (with userKey) every group a given person belongs to. Returns one page plus a nextCursor when more exist; the Admin SDK reports no total. |
Get group (yekar.google-workspace.get-group) | Read | Read one group's record: name, description, aliases, and Google's own count of direct members (that count comes from the group resource, not from counting a page of members). |
List group members (yekar.google-workspace.list-group-members) | Read | List a group's DIRECT members with their roles. A nested group appears as one member of type GROUP rather than being expanded - so this answers 'what is in this group', not 'who ultimately receives its mail'. Paginated via nextCursor; no total is available. |
List org units (yekar.google-workspace.list-org-units) | Read | List the customer's org units, whole subtree or immediate children. Use it to discover the exact orgUnitPath strings that List users and Update user take - a mistyped path is a 400, not an empty result. |
List domains (yekar.google-workspace.list-domains) | Read | List the Workspace customer's domains and which one is primary. Useful before creating a group (its address must sit on one of these) and for telling a multi-domain tenant apart from a single-domain one. |
List audit events (yekar.google-workspace.list-audit-events) | Read | Read the Workspace audit trail for one application - sign-ins and failures, admin-console changes, third-party OAuth grants, group changes, Drive activity. Filterable by actor, event name and time window. The read behind security automations ('who granted an app access last week', 'failed logins for this account'). Paginated via nextCursor; the Reports API gives no total. |
Set user suspended (yekar.google-workspace.set-user-suspended) | Write | Suspend or restore a user account. Suspension blocks sign-in and mail delivery while keeping the account and all its data intact, and it is fully reversible by calling this again with suspended=false - it is the offboarding verb this integration offers. Deleting a user is not offered at all, because that destroys their Drive and mail. |
Update user (yekar.google-workspace.update-user) | Write | Update a user's name, recovery contact, or org unit - the org-unit field is how a user is moved between OUs. Every field is an absolute value, so re-running the same call is safe. Cannot set passwords or create accounts; use the Admin console for those. |
Sign out user (yekar.google-workspace.sign-out-user) | Write | Invalidate all of a user's web sessions, forcing a fresh sign-in everywhere. The incident-response verb: pair it with Set user suspended when an account may be compromised, since suspending alone does not always end sessions already open. |
Create group (yekar.google-workspace.create-group) | Write | Create a group at the given address. Creating an address that already exists is reported as a conflict carrying the existing group's id, so a retry can proceed against it instead of failing blind. |
Update group (yekar.google-workspace.update-group) | Write | Change a group's display name or description. Absolute values, so re-running the same call is safe. The group's address is not editable here - that is a rename with mail-routing consequences, and it belongs in the Admin console. |
Add group member (yekar.google-workspace.add-group-member) | Write | Add a user (or another group, which nests it) to a group with a role. Adding someone who is already a member is reported as a conflict rather than silently changing their role - use Set group member role for that. |
Set group member role (yekar.google-workspace.set-group-member-role) | Write | Set an existing member's role in a group (MEMBER, MANAGER, OWNER) - the promote/demote verb, so a role change needs no remove-and-re-add. The role is an absolute value, so re-running is safe. A member who isn't in the group is reported as not found. |
Remove group member (yekar.google-workspace.remove-group-member) | Write | Remove a member from a group. Removing someone who isn't a member is reported as not found rather than as success - 'they're not in it' and 'I took them out' are different facts, and an access-review automation needs to tell them apart. Removing a member does not touch their account. |
Notes
- Bind this as a domain (service) connection owned by a Workspace admin - an ordinary user's connection gets a permission error on the first call.
- Start with Get organization profile to confirm WHICH Workspace the connection points at before changing anything.
- Offboarding is Set user suspended (reversible) plus Sign out user - account deletion is not offered, because it destroys the account's Drive and mail.
- List users takes Directory search syntax (
email:alice*, isSuspended=true, orgName=Engineering); List org units gives you the exact orgUnitPath strings to filter or move users with. - List tools return one page and a nextCursor - the Admin SDK reports no total, so the rows you get back are never a count of the directory.
- Passwords and admin-role grants stay in the Admin console on purpose; no tool here can set them.