Google Apps Developer Blog: Administrative APIs

Google Apps Admin SDK: Introducing the Roles API

October 21, 2015

Posted by Rishi Dhand, Product Manager, Google Apps Admin SDK and Wesley Chun, Developer Advocate, Google AppsIn a Google Apps domain, Admin role management (i.e. create, assign, and update admin roles) is a critical function for super admins that helps them distribute admin responsibilities in a more secure manner. Until now, this functionality was only available via the Admin console UI.

This is what Role management looks like in the Admin console, but now you can also do this programmatically with the Roles API.
Today’s launch of the Roles API (one of the Admin SDK Directory APIs) enables developers to build admin tools that can perform role management programmatically.This new API will be useful to admins who have either built internal admin tools using the Admin SDK, or developers of third-party admin tools. Both can now use the Roles API to provide selective access to Delegated Admins (DAs) to specific admin capabilities within third-party applications.Here are some examples of use cases where the Roles API can be leveraged:

A third-party user management app that relies on the Admin SDK to perform various user related operations can now use the Roles API to selectively show the capabilities of User management DAs, such as creating/deleting users or resetting passwords.

A mobile device management (MDM) app developer looking to build a tool for access by Mobile Management DAs can use the Roles API to determine the privileges of the logged-in DA and selectively display MDM related admin functionality.

Admins (or admin tools) can now programmatically create reports on admin role assignments which can help super admins better manage access to DAs.

For more information and to get started, please check out the Roles API documentation. We look forward to helping more admins manage their domains in a more programmatic way so they can focus on more critical aspects of managing their corporate IT infrastructure.

Deprecating ScriptDB and Domain Service in Apps Script

May 15, 2014

In the last few months, we've added a number of new features to Google Apps Script, including add-ons for Sheets and Docs and 7 new advanced services.We're eager to maintain that momentum — focusing on new features that help you do more with Google Apps. As a result, we're deprecating two Apps Script services for which good replacements exist elsewhere: ScriptDB (a NoSQL database that has been marked as experimental since it was introduced) and the Domain service (which encapsulates the GroupsManager, NicknameManager, and UserManager global objects).Both ScriptDB and the Domain service will be turned off on November 20, 2014.Before then, you'll need to port any ScriptDB projects to another data store, like Google Cloud SQL or a third-party NoSQL database. We've created a migration guide that explains how to export your data from ScriptDB and suggests a few alternate data stores. We have also improved the documentation for connecting to external databases through JDBC to make it a little easier for you to set up Cloud SQL with Apps Script.The Domain service, which only Google Apps domain administrators can use, is replaced by the recently added Admin SDK Directory and Admin SDK Reports advanced services. Those advanced services also provide many new features that the Domain service does not — like managing users' devices, OAuth tokens, and application-specific passwords — so we expect that you'll prefer using them in the future.

Saurabh Gupta profile | twitter | blog

As the product manager for Google Apps Script, Saurabh is responsible for Apps Script’s overall vision and direction.

Introducing push notifications and structured user search in the Admin SDK

February 3, 2014

Since we launched the Admin SDK in May 2013, we’ve been constantly improving it based on your feedback and feature requests. Our first API updates of 2014 bring some features at the top of your requests: push notifications for users, push notifications for activities, and structured user search.

Push notifications for users

Tired of polling user resources to detect changes? With push notifications for users, you can watch for changes to user resources and receive notifications from the Directory API whenever a watched user resource changes.

Check out our user notifications developer guide to learn how to improve the performances of your application by eliminating the extra network and compute costs involved with polling user resources.

Push notifications for activities

Do you want to be notified when changes to a certain document occur or specific events such as the change of a user’s password happen? With push notifications for activities you can watch for changes to activities resources, and receive notifications from the Reports API whenever a watched activity resource changes.

Check out our activities notifications developer guide to learn how to receive notifications for the activities of your interest.

Structured user search

Do you want to know which users in your domain are members of a certain organization, or which users have a common manager in their reporting chain? The new query parameter we’ve just added to the users.list method of the Directory API allows you to perform rich queries over most attributes from the user profile.

For example, you can now retrieve all the users in the Human Resources org by using the query:

orgName='Human Resources'

Or you can retrieve all the users with janesmith@example.com in their reporting chain by using the query:

manager='janesmith@example.com'

Check out our user search developer guide for a more comprehensive guide on how to build your queries and more examples of what you can do.

Silvano Luciani

Silvano is a Developer Programs Engineer on Google's Admin SDK. Before joining Google in 2011, he has worked in Finland, Italy, Spain and the UK, writing web based configuration management tools for ISPs, social networks, web based training materials, e-commerce apps and more.

New security management features for domain users with the Admin SDK

November 21, 2013

We launched the Admin SDK in May as a new way for developers to build customized administrative tools for organizations that use Google Apps. A top priority for most administrators is keeping their users safe. Today, we're adding new security management features to the Directory API to help administrators manage:

Access granted by domain users to third-party applications

Application specific passwords created by users

Backup verification codes for users using 2-step verification.

As an example, FlashPanel, a popular tool used by Google Apps administrators, is using these new features to allow domain admins to review installed applications and manage or revoke access to them. The Apps Explorer in FlashPanel allows admins to see which are the most installed apps in his domain or use a filter to review applications by type of permissions (Drive, GMail, etc). It also allows admins to review the number of users who have granted access to a particular application.The screenshot below shows an example of FlashPanel’s customized view of third-party application installs.

In FlashPanel’s integration, admins have the power to whitelist or blacklist apps, as shown below.

The Directory API now also provides the ability to manage admin notifications that are delivered to the Admin Console. Currently, admins receive notifications for events that affect their domains such as users approaching their storage limits or monthly bills that are due. Now you can use the API to list notifications, update their read status, or pull them into custom tools.If you are interested in using these new endpoints, please refer to the Directory API documentation.

Ajay Guwalani

Ajay Guwalani is Product Manager on Google Apps Admin APIs. His current focus is to build next generation admin APIs to make enterprise developers and admins happy.

Your apps + Google Apps = awesome

November 19, 2013

Admin SDKGoogle+ API for DomainsGoogle Appssome significant changesour documentation hereImproved securityConsistent development experienceTest before publishingSimplified publishing experienceDeeper integrationGoogle’s new app launcherEasier discoverabilityPromevo gPanelDraw.ioUberConferenceAODocsSpanning Calendar UndeleteFlashpanelMindMeister

Arun Nagarajan profile

Arun is a Developer Advocate on Google Apps. Arun works closely with the community of partners, customers and developers to help them build compelling applications on top of Google Apps. Arun is originally from the Boston area and enjoys basketball and snowboarding.

Monitor user logins, storage consumption and apps usage with the Admin SDK

September 25, 2013

Security is a top priority for Google, just as it is for many of our Google Apps customers. As a domain administrator, a big part of keeping your users safe is knowing when and how they are using their accounts. Since we launched the Admin SDK Reports API in June, we've continued to add features to let you more easily visualize Google Apps' usage and security in your domain. These new features include:Security Reports

Login audit—View all web browser based logins with IP information for all users in your domain. You can use this data to monitor all successful, failed, and suspicious logins in your domain.

Authorized applications—View a list of third-party applications that users in your domain have shared data with. Gain visibility into how many users are accessing each application. Revoke access to specific apps using the security tab on Admin console.

Usage Reports

Storage quota—View user-level quota usage. This is available both as total usage and split by Gmail, Drive and Google+ photos for every user in the domain. Monitor which users are nearing their quota limits and acquire more storage if necessary.

Google+ usage—View 1-day, 7-day and 30-day active Google+ usage in your domain. See the number of Hangouts attended by users in your domain.

Refer to the Reports API documentation for more details on how to use the Reports API and to see what is possible with all of our entire Admin SDK.

Rishi Dhand profile

Rishi Dhand is a Product Manager on the Google Apps for Business team. In addition to working on data migration features, he also works on the Google Apps administration platform with focus on building new security and admin reporting features. In his free time, he enjoys playing squash and badminton.

Admin SDK and Google+ APIs for business

May 16, 2013

Directory API Reports API Google+ Domains APILet us knowAPI documentationGoogle APIs ConsoleStack OverflowNote about API deprecation:

Ajay Guwalani

Ajay Guwalani is Product Manager on Google Apps Admin APIs. His current focus is to build next generation admin APIs to make enterprise developers and admins happy.

Migrating to Google Apps just got easier

November 23, 2012

Ever wondered how to move your organization’s emails from a shared mailbox or a public folder when migrating to Google Apps for Business?We’ve just launched the Google Apps Groups Migration API that provides Google Apps developers the ability to build tools that can move shared emails from any data source (typically shared mailboxes, public folders and discussion databases) to their domain’s Google Groups discussion archives. Google Groups provides a simple and easy way to ‘tag’ the migrated emails into manageable groups that can be easily accessed by users with group membership.This new api complements existing Google Groups api’s like Google Apps Provisioning API which can be used to create new groups (to which the shared emails can then be migrated using the newly launched API) and Google Apps Groups Settings API which can be used to control access to the group. The addition of the Google Apps Groups Migration API thus makes the ‘shared folder’ experience seamless even after migration to Google Apps. To learn more and try out this new feature visit Google Developers.

Rishi Dhand profile

Rishi Dhand is a product manager working for the Google apps for business team. In addition to working on data migration features, he also works Google apps administration platform with focus on building new security and admin reporting features. In his free time, he enjoys playing squash and badminton.

A programmatic way to managing licenses for Google Apps administrators

August 21, 2012

We know many organizations using Google Drive storage or Google Maps Coordinate have hundreds or even thousands of users to which licenses need to be assigned. That’s why we’re pleased to announce a more streamlined method for managing these licenses using the Enterprise License Manager API. The API offers a simple and faster way to access the functionality of the License Manager user interface. It can be used to programmatically assign, unassign and re-assign Google Drive storage or Google Maps Coordinate licenses to users in your domain. Google Apps reseller administrators and their customers can also use the API for the same programmatic license assignment.To begin using the Google Enterprise License Manager API today, follow the instructions in the API documentation. You will need to sign in to the Google APIs Console and activate the API. If you have any questions about this API, please ask them in the Domain Information and Management APIs forum.

Alex Jos

Alex is an engineer working on Google enterprise. His current interests include designing for performance and low latency, security, web services, statistics and ranking.

Keshav Darak

Keshav is an engineer working on Google enterprise with interests in parallel processing and distributed systems. In his spare time he plays ping pong.

Automatically setting a vacation responder from a calendar event

January 3, 2012

Are you ever at an airport with no internet access, and realize that you forgot to set your "Out of Office" (OOO) message?" I forget regularly, but always remember to block off my calendar. Why not have the calendar automatically update my OOO message? We can! With the Calendar API, we can retrieve calendar events and set a vacation responder for the event duration for any user in the domain using the Email Settings API. The first step is to authorize the Calendar and Email Settings client to make any call to the APIs respectively. The new Calendar API requires google-api-client library while the Email settings API still works with the gdata-client library in Python. These libraries use different underlying protocols and handle authorization differently. Fortunately we can use the same code to get an OAuth 2.0 token for both the Calendar API and the Email Settings API.from oauth2client.file import Storage from oauth2client.client import AccessTokenRefreshError from oauth2client.client import OAuth2WebServerFlow from oauth2client.tools import run SCOPES = ('https://www.googleapis.com/auth/calendar ' 'https://apps-apis.google.com/a/feeds/emailsettings/2.0/') FLOW = flow_from_clientsecrets('client_secrets.json', scope=SCOPES) storage = Storage('vacation.dat') credentials = storage.get() if credentials is None or credentials.invalid: credentials = run(FLOW, storage) Now that we have obtained the OAuth 2.0 token from OAuth2WebServerFlow, we can use it in either library. To authorize the Calendar service:# Create an httplib2.Http object to handle the HTTP # requests and authorize it with our good Credentials. http = httplib2.Http() http = credentials.authorize(http) # Build authorized service for Calendar API service = build('calendar', 'v3', http=http) Authorizing the Email Settings client requires adapting the credentials:auth2token = gdata.gauth.OAuth2Token(client_id=client_id, client_secret=client_secret, scope=SCOPE, access_token=credentials.access_token, refresh_token=credentials.refresh_token, user_agent='vacation-responder-sample/1.0') email_client = auth2token.authorize( gdata.apps.emailsettings.client.EmailSettingsClient( domain=domain)) Now its time to update the vacation responder based on calendar event using the authorized client. Lets query for events containing the string ‘vacation’ from the Calendar API. The following code snippet shows the retrieval of events.# Convert the date to the RFC 3339 timestamp format # for Calendar API. cur_datetime = datetime.datetime.now() cur_date = cur_datetime.strftime('%Y-%m-%dT%H:%M:%SZ') events = service.events().list(calendarId=username, q='vacation', timeMin=cur_date, singleEvents=True, orderBy='startTime').execute() By specifying a user’s email address as the calendarID, we can query against any primary calendars in our domain that are shared and readable by the administrator. If the user opts to hide their calendar, we won’t find any of their events. For additional details about the query on calendar events, refer to the calendar query parameters from the reference guide.Next we can obtain the start and end time of the event and update the vacation responder using the Email Settings client if the event’s duration is day long or more.if 'items' in events: for event in events['items']: startDate = event['start'] endDate = event['end'] # If event is set for the day not just for a time slot. if 'date' in startDate: email_client.UpdateVacation(username=username, enable=True, subject='Out of office', message='If urgent call me.', domain_only=True, start_date=startDate['date'], end_date=endDate['date']) print '\nVacation responder set for the days between %s to %s' % (startDate['date'], endDate['date']) break You can download the sample and build your own application on top of it. We hope that this sample makes it easier to get started, particularly for apps that need to combine APIs from the two API clients. Please feel free to reach us in the Google Domain Info and Management Forum with any questions you have or write us feedback on this post.

Shraddha Gupta profile

Shraddha is a Developer Programs Engineer for Google Apps. She has her MTech in Computer Science and Engineering from IIT Delhi, India.

Managing groups using the new Groups Settings API

December 22, 2011

The recently launched Groups Settings API allows Google Apps domain administrators to write client applications for managing groups in their domain. Once you have created the groups and added members using the Provisioning API, you can use the Groups Settings API to perform actions like:

manage access to the group

configure discussion archiving

configure message moderation

edit a group's description, display format and custom fields

Let’s have a look at how you can make authorized calls to the Groups Settings API from your client application.Getting StartedYou must enable the Provisioning API to make requests to the Groups Settings API. You can do so by enabling the Provisioning API checkbox in the Domain settings tab of your Google Apps control panel. Next, ensure that the Google Groups for Business and Email services are added to your domain by going to the Dashboard. If these services are not listed, add them by going to Add more services link next to the Service settings heading.Now you are set to write client applications. Let's discuss the steps to write an application using the Python client library. You need to install the google-api-python-client library first. You can register a new project or use an existing one from the APIs console to obtain credentials to use in your application. The credentials (client_id, client_secret) are used to obtain OAuth tokens for authorization of the API requests. Authorization using OAuth 2.0The Groups Settings API supports various authorization mechanisms, including OAuth 2.0. Please see the wiki for more information on using the library’s support for OAuth 2.0 to create a httplib2.Http object. This object is used by the Groups Settings service to make authorized requests.Make API requests with GroupSettings serviceThe Python client library uses the Discovery API to build the Groups Settings service from discovery. The method build is defined in the library and can be imported to build the service. The service can then access resources (‘groups’ in this case) and perform actions on them using methods defined in the discovery metadata.The following example shows how to retrieve the properties for the group staff@example.com. service = build(“groups”, “v1”, http=http) group = service.groups() g = group.get(groupUniqueId=”staff@example.com”).execute()This method returns a dictionary of property pairs (name/value):group_name = g['name'] group_isArchived = g['isArchived'] group_whoCanViewGroup = g['whoCanViewGroup']The update method can be used to set the properties of a group. Let’s have a look at how you can set the access permissions for a group:body = {'whoCanInvite': ALL_MANAGERS_CAN_INVITE, 'whoCanJoin': ‘INVITED_CAN_JOIN’, 'whoCanPostMessage': ‘ALL_MEMBERS_CAN_POST’, 'whoCanViewGroup': ‘ALL_IN_DOMAIN_CAN_VIEW’ } # Update the properties of group g1 = group.update(groupUniqueId=groupId, body=body).execute()Additional valid values for these properties, as well as the complete list of properties, are documented in the reference guide. We have recently added a sample in the Python client library that you can refer to when developing your own application. We would be glad to hear your feedback or any queries you have on the forum.

Shraddha Gupta profile

Shraddha is a Developer Programs Engineer for Google Apps. She has her MTech in Computer Science and Engineering from IIT Delhi, India.

Doodles for your Google Apps domain

December 19, 2011

Since 1998, when the first doodle was released, they have been one of the most loved features of the Google home page. There have been doodles to celebrate all kinds of events, including national holidays, birthdays of artists and scientists, sports competitions, scientific discoveries and even video games! Also, doodles have evolved from simple static images to complex applications, such as the interactive electric guitar used to celebrate the birthday of Les Paul.Want your company logo to change for selected events or holidays, just like doodles? The Admin Settings API allows domain administrators to write scripts to programmatically change the logo of their Google Apps domain, and Google App Engine offers the ability to configure regularly scheduled tasks, so that those scripts can run automatically every day.With these two pieces combined, it is pretty easy to implement a complete solution to change the domain logo on a daily basis (assuming the graphic designers have prepared a doodle for each day), as in the following screenshot:

Let’s start with a Python App Engine script called doodleapps.py:import gdata.apps.adminsettings.service from google.appengine.ext import webapp from google.appengine.ext.webapp import util from datetime import date class DoodleHandler(webapp.RequestHandler): # list of available doodles DOODLES = { '1-1': 'images/newyearsday.jpg', '2-14': 'images/valentinesday.jpg', '10-31': 'images/halloween.jpg', '12-25': 'images/christmas.jpg' } # returns the path to the doodle corresponding to the date # or None if no doodle is available def getHolidayDoodle(self, date): key = '%s-%s' % (date.month, date.day) if key not in self.DOODLES: return None return self.DOODLES[key] # handles HTTP requests by setting today’s doodle def get(self): doodle = self.getHolidayDoodle(date.today()) self.response.out.write(doodle) if doodle: service = gdata.apps.adminsettings.service.AdminSettingsService() // replace domain, email and password with your credentials // or change the authorization mechanism to use OAuth service.domain = 'MYDOMAIN.COM' service.email = 'ADMIN@MYDOMAIN.COM' service.password = 'MYPASSWORD' service.source = 'DoodleApps' service.ProgrammaticLogin() # reads the doodle image and update the domain logo doodle_bytes = open(doodle, "rb").read() service.UpdateDomainLogo(doodle_bytes) # webapp initialization def main(): application = webapp.WSGIApplication([('/', DoodleHandler)], debug=True) util.run_wsgi_app(application) if __name__ == '__main__': main()The script uses a set of predefined doodles which can be edited to match your list of images or replaced with more sophisticated logic, such as using the Google Calendar API to get the list of holidays in your country.Every time the script is triggered by an incoming HTTP request, it will check whether a doodle for the date is available and, if there is one, update the domain logo using the Admin Settings API.In order for this script to be deployed on App Engine, you need to to configure the application by defining a app.yaml file with the following content:application: doodleapps version: 1 runtime: python api_version: 1 handlers: - url: .* script: doodleapps.pyWe want the script to run automatically every 24 hours, without the need for the administrator to send a request, so we also have to define another configuration file called cron.yaml:cron: - description: daily doodle update url: / schedule: every 24 hoursOnce the application is deployed on App Engine, it will run the script on a daily basis and update the logo.The holiday season is upon us. Could there be a better time for your company to start using doodles?Happy Holidays!

Claudio Cherubino profile | twitter | blog

Claudio is a Developer Programs Engineer working on Google Apps APIs and the Google Apps Marketplace. Prior to Google, he worked as software developer, technology evangelist, community manager, consultant, technical translator and has contributed to many open-source projects, including MySQL, PHP, Wordpress, Songbird and Project Voldemort.

Domain user management with Apps Script

December 19, 2011

Managing the user accounts in a Google Apps domain can be a daunting task when you have hundreds or thousands of them and you have no tools to automate the process. The Google Apps Provisioning API allows developers to write user management applications in the programming language of their choice, but many system administrators prefer a script-based solution instead. The recently launched UserManager Apps Script service fills the gap, providing Google Apps domain administrators an easy way to automate tasks such as batch user creation or update.With the new Apps Script service, creating a user will be as easy as writing a single line of code:var user = UserManager.createUser("newuser", "John", "Smith", "mypassword");The UserManager service also makes it easy to perform the same task on each account in the domain. The following sample shows how you can force all users to change their passwords at the next login:var users = UserManager.getAllUsers(); for (var i in users) { users[i].setChangePasswordAtNextLogin(true); }Calls to the UserManager service can also be scheduled to run hourly or daily, or in response to certain events thanks to Apps Script Triggers.Interested in what else you can do with the UserManager service? Please check the documentation and get in touch with us on the the forum for any questions about its usage or to share more info about your project with the community.

Claudio Cherubino profile | twitter | blog

More administrative APIs now available to all Google Apps editions

December 15, 2011

Google Apps domain administrators have access to a number of APIs to automate their management activities or to integrate with third-party applications, including the Provisioning API to manage user accounts and groups, the Admin Audit API, Admin Settings API, and the Reporting API.These APIs were only available in Google Apps for Business, Education and ISP editions but many administrators of the free version of Google Apps also requested access to them. I’m glad to say that we listened to your feedback and, starting today, we made the these APIs available to all Google Apps editions.Please check the documentation as the starting point to explore the possibilities of the APIs and post on our forum if you have questions or comments.

Claudio Cherubino profile | twitter | blog

Using the new JS library to unlock the power of Google Apps

December 1, 2011

Yesterday, the Google APIs Client Library for JavaScript was released, unlocking tons of possibilities for fast, dynamic web applications, without requiring developers to run their own backend services to talk to Google APIs. This client library supports all discovery-based APIs, including the Google Tasks, Google Calendar v3 and Groups Settings APIs. To make it easy to get started using the JS client with Google Apps APIs, we’ve provided an example below.After you’ve configured your APIs console project as described in the client library instructions, grab a copy of your client ID and API key, as well as the scopes you need to access the API of your choice.var clientId = 'YOUR_CLIENT_ID'; var apiKey = 'YOUR_API_KEY'; var scopes = 'https://www.googleapis.com/auth/calendar';You’ll also need several boilerplate methods to check that the user is logged in and to handle authorization:function handleClientLoad() { gapi.client.setApiKey(apiKey); window.setTimeout(checkAuth,1); checkAuth(); } function checkAuth() { gapi.auth.authorize({client_id: clientId, scope: scopes, immediate: true}, handleAuthResult); } function handleAuthResult(authResult) { var authorizeButton = document.getElementById('authorize-button'); if (authResult) { authorizeButton.style.visibility = 'hidden'; makeApiCall(); } else { authorizeButton.style.visibility = ''; authorizeButton.onclick = handleAuthClick; } } function handleAuthClick(event) { gapi.auth.authorize( {client_id: clientId, scope: scopes, immediate: false}, handleAuthResult); return false; }Once the application is authorized, the makeApiCall function makes a request to the API of your choice. Here we make a request to retrieve a list of events from the user’s primary calendar, and use the results to populate a list on the page:function makeApiCall() { gapi.client.load('calendar', 'v3', function() { var request = gapi.client.calendar.events.list({ 'calendarId': 'primary' }); request.execute(function(resp) { for (var i = 0; i < resp.items.length; i++) { var li = document.createElement('li'); li.appendChild(document.createTextNode(resp.items[i].summary)); document.getElementById('events').appendChild(li); } }); }); }To tie all of this together, we use the following HTML, which configures the DOM elements we need to display the list, a login button the user can click to grant authorization, and a script tag to initially load the client library:<html> <body> <div id='content'> <h1>Events</h1> <ul id='events'></ul> </div> <a href='#' id='authorize-button' onclick='handleAuthClick();'>Login</a> <script> // Insert the JS from above, here. </script> <script src="https://apis.google.com/js/client.js?onload=handleClientLoad"></script> </body> </html>Making requests to other discovery-based APIs, such as the Tasks API requires only small modifications to the above:

Replace the contents of the scopes variable to use the appropriate scope for the other API.

Modify makeApiCall to load the appropriate API and version.

Modify request (and the execute callback) to load a different API method and handle the response.

As additional discovery-based APIs are released, they’ll be automatically supported by the library (just like the Python and Ruby clients).If you have general questions about the JS client, check out the JavaScript client group. For questions on specific Apps APIs come find us in the respective Apps API forum.

Dan Holevoet profile

Dan joined the Google Developer Relations team in 2007. When not playing Starcraft, he works on Google Apps, with a focus on the Calendar and Contacts APIs. He's previously worked on iGoogle, OpenSocial, Gmail contextual gadgets, and the Google Apps Marketplace.

Using OAuth 2.0 with the Provisioning API in Python

November 28, 2011

Google Apps domain administrators can programmatically create and manage users, groups, nicknames and organization units using the Provisioning API.Support for OAuth 2.0 in the Provisioning API allows Google Apps domain administrators to authorize access to the API without sharing their passwords. After the administrator agrees to grant access, an OAuth 2.0 token makes sure that an application gets access to the right scope of resources for API calls.We have recently added a new sample to the Python client library to demonstrate authorization with OAuth 2.0 for an application combining the Provisioning API and the Email Settings API. This sample app iterates through each user on a domain and creates an e-mail filter to mark all messages from outside the domain as “read.” For a step-by-step walkthrough of the sample, have a look at our new article: OAuth 2.0 with the Provisioning and the Email Settings API. We would be glad to hear your feedback or any questions you have on the Google Apps Domain Info and Management APIs forum.

Shraddha Gupta profile

Shraddha is a Developer Programs Engineer for Google Apps. She has her MTech in Computer Science and Engineering from IIT Delhi, India.

Parsing exported mailboxes using Python

November 27, 2011

Google Apps domain administrators can use the Email Audit API to download mailbox accounts for audit purposes in accordance with the Customer Agreement. To improve the security of the data retrieved, the service creates a PGP-encrypted copy of the mailbox which can only be decrypted by providing the corresponding RSA key.When decrypted, the exported mailbox will be in mbox format, a standard file format used to represent collections of email messages. The mbox format is supported by many email clients, including Mozilla Thunderbird and Eudora. If you don’t want to install a specific email client to check the content of exported mailboxes, or if you are interested in automating this process and integrating it with your business logic, you can also programmatically access mbox files.You could fairly easily write a parser for the simple, text-based mbox format. However, some programming languages have native mbox support or libraries which provide a higher-level interface. For example, Python has a module called mailbox that exposes such functionality, and parsing a mailbox with it only takes a few lines of code:import mailbox def print_payload(message): # if the message is multipart, its payload is a list of messages if message.is_multipart(): for part in message.get_payload(): print_payload(part) else: print message.get_payload(decode=True) mbox = mailbox.mbox('export.mbox') for message in mbox: print message['subject'] print_payload(message)Let me know your favorite way to parse mbox-formatted files by commenting on Google+.For any questions related to the Email Audit API, please get in touch with us on the Google Apps Domain Info and Management APIs forum.

Claudio Cherubino profile | twitter | blog

A more efficient way to manage your Google Groups settings

November 9, 2011

If you’re a Google Apps administrator and you want to create multiple Google Groups for your domain, you can do so using the Google Apps Provisioning API. However, until today, there was no way for you to programmatically update the settings for the groups you created. Some organizations have hundreds or even thousands of groups, and you’ve told us that you want a more streamlined method for managing these groups’ settings. That’s why we’re pleased to announce the Google Apps Groups Settings API, which allows you to control settings for all of your groups much more efficiently.The Google Apps Groups Settings API is available for Google Apps for Business, Education and ISPs and can be used to manage:

Access settings for a group, such as who can subscribe and post

Email delivery settings, including maximum message size and reply options

Message moderation settings, such as whether messages from new members should be moderated, all messages should be moderated, or no moderation should be used

To begin using the Google Groups Settings API today, follow the instructions in the API documentation. You will need to sign in to the Google APIs Console and request access to the API. We hope the API will allow you to more quickly and easily manage all of the groups in your domain. If you have any questions about this API, please ask them in the Domain Information and Management APIs forum.

Piyush Nigam profile | twitter | site

Piyush is a Google software engineer in India working on Google Apps APIs. His interests are generally in scalable architectures and web services. Before joining Google he worked on large scale platform systems at Amazon.

Announcing Version 1.9 of the .NET Library for Google Data APIs

September 8, 2011

We have released version 1.9 of the .NET Library for Google Data APIs and it is available for download.This version adds the following new features:

support for 3-legged OAuth

two new sample applications: BookThemAll (mashup of Calendar and Provisioning APIs) and UnshareProfiles (showcasing a new feature of the Google Apps Profiles API)

updates to the Content for Shopping API to implement 20+ new item attributes

support for new yt:rating system and Access Control settings to the YouTube API

This new version also removes the client library for the deprecated Google Base API and fixes 20 bugs.For more details, please check the Release Notes and remember to file feature requests or bugs in the project issue tracker.

Claudio Cherubino profile | twitter | blog

Rich signatures for your domain using the Email Settings and the Profiles APIs

August 23, 2011

pre.code br { display:none; }recent additionGoogle Apps Profiles APIGoogle Data APIs Python Client LibraryAdvanced Tools - Manage OAuth domain keyimport gdata.apps.emailsettings.client
import gdata.contacts.client
# replace these values with yours

CONSUMER_KEY = 'mydomain.com'
CONSUMER_SECRET = 'my_consumer_secret'
company_name = 'ACME Inc.'
admin_username = 'admin'2-legged OAuthxoauth_requestor_id# request a 2-legged OAuth token
requestor_id = admin_username + '@' + CONSUMER_KEY
two_legged_oauth_token = gdata.gauth.TwoLeggedOAuthHmacToken(
CONSUMER_KEY, CONSUMER_SECRET, requestor_id)

# Email Settings API client
email_settings_client = gdata.apps.emailsettings.client.EmailSettingsClient(
domain=CONSUMER_KEY)
email_settings_client.auth_token = two_legged_oauth_token

# User Profiles API client
profiles_client = gdata.contacts.client.ContactsClient(
domain=CONSUMER_KEY)
profiles_client.auth_token = two_legged_oauth_tokenHtmlSignature()# helper class used to build signatures
class SignatureBuilder(object):
def HtmlSignature(self):
signature = '%s' % self.name
if self.occupation:
signature += '%s' % self.occupation
if self.company:
signature += '%s' % self.company
signature += 'Email: <a href=\'mailto:%s\'>%s</a> - Phone: %s' % (
self.email, self.email, self.phone_number)
return signature

def __init__(
self, name, company='', occupation='', email='', phone_number=''):
self.name = name
self.company = company
self.occupation = occupation
self.email = email
self.phone_number = phone_numberGetProfilesFeed()next# get all user profiles for the domain
profiles = []
feed_uri = profiles_client.GetFeedUri('profiles')
while feed_uri:
feed = profiles_client.GetProfilesFeed(uri=feed_uri)
profiles.extend(feed.entry)
feed_uri = feed.FindNextLink()
SignatureBuildernamecompanyoccupationemailphone_number# extract relevant pieces of data for each profile
for entry in profiles:
builder = SignatureBuilder(entry.name.full_name.text)
builder.company = company_name
if entry.occupation:
builder.occupation = entry.occupation.text
for email in entry.email:
if email.primary and email.primary == 'true':
builder.email = email.address
for number in entry.phone_number:
if number.primary and number.primary == 'true':
builder.phone_number = number.text

# build the signature
signature = builder.HtmlSignature()UpdateSignatureProvisioning API# entry.id has the following structure:
# http://www.google.com/m8/feeds/profiles/domain/DOMAIN_NAME/full/USERNAME
# the username is the string that follows the last /
username = entry.id.text[entry.id.text.rfind('/')+1:]# set the user's signature using the Email Settings API
email_settings_client.UpdateSignature(username=username,
signature=signature)documentationforums

Claudio Cherubino profile | twitter | blog

Apps Developer Blog

Google Apps Admin SDK: Introducing the Roles API

Deprecating ScriptDB and Domain Service in Apps Script

Introducing push notifications and structured user search in the Admin SDK

New security management features for domain users with the Admin SDK

Your apps + Google Apps = awesome

Monitor user logins, storage consumption and apps usage with the Admin SDK

Admin SDK and Google+ APIs for business

Migrating to Google Apps just got easier

A programmatic way to managing licenses for Google Apps administrators

Automatically setting a vacation responder from a calendar event

Managing groups using the new Groups Settings API

Doodles for your Google Apps domain

Domain user management with Apps Script

More administrative APIs now available to all Google Apps editions

Using the new JS library to unlock the power of Google Apps

Using OAuth 2.0 with the Provisioning API in Python

Parsing exported mailboxes using Python

A more efficient way to manage your Google Groups settings

Announcing Version 1.9 of the .NET Library for Google Data APIs

Rich signatures for your domain using the Email Settings and the Profiles APIs

Labels

Archive

Feed

Company-wide

Products

Developers