As a reseller, how do I create a new Google Apps user using the Admin SDK Directory API?

Question

As we transition from the deprecated Provisioning API over to the new Directory API, I see some gaping holes in the documentation in regards to how I as a reseller can manage my customers (Google Apps customers). Specifically, I'd like to know how I can use my Reseller OAUTH credentials to create a new user on behalf of one of my customers (as was possible in the Provisioning API) using the following endpoint:

https://developers.google.com/admin-sdk/directory/v1/reference/users/insert

In the above documentation, I don't see a reference to a customer's account. The only parameters that I believe may be useful are organizations and externalIds. There's little documentation as to what these do. I was thinking of testing the following scenarios:

            $params = array(
            'externalIds' => array(
                array(
                    'type'          => 'customer', // or 'account'?
                    'value'         => $data['domain']
                )
            ),
            'organizations'     => array(
                array(
                    'name'          => $data['domain'],
                    'domain'        => $data['domain'],
                    'type'          => 'domain_only',
                    'primary'       => true
                )
            )
            );

Likewise, when performing operations on an existing user such as retrieval of a customer, I don't see where I can specify which Google Apps account the specific user is tied to:

https://developers.google.com/admin-sdk/directory/v1/reference/users/get

In this case, there's not even parameters for organization or externalIds, so I have no idea how retrieval could be specific to a particular customer under my reseller account.

I need to be able to perform these actions as I was able to in the old Provisioning API on behalf of my customers using only my Reseller account OAUTH credentials.

Any help would be appreciated.

Emily · Accepted Answer · 2013-10-22T20:44:30.790

3

Let's say my reseller account is reseller.com, and my resold domain is resold.com. In order to create a user on behalf of my resold domain, here is the call that I will make using my own reseller credential.

(https://developers.google.com/admin-sdk/directory/v1/guides/manage-users?hl=ja#create_user)

POST /admin/directory/v1/users HTTP/1.1
{
 "name": {
  "familyName": "Lam",
  "givenName": "Emily"
 },
 "password": "anythingyouwant",
 "primaryEmail": "emily@resold.com"
}

What you input in the primaryEmail field is where the user will be created. If you take a look at your resold domain admin console now, you will see that a user is now created.

Now again for retrieval, it is the same deal.

GET /admin/directory/v1/users/emily@resold.com

You will create these users and retrieve these users using your reseller credential as if you are the super admin of their domains. Here is the catch....

If the "Enable API access" is not manually checked in your resold domain Admin console (by default, this is now automatically checked for all newly resold domains at the moment), you can't make calls on behalf of the resold domains.

The button is in Admin Console -> Security -> API reference -> Enable API access

enter image description here

edited Oct 22 '13 at 20:44

answered Oct 17 '13 at 16:41

Emily

1,464
1
9
12

Thanks so much Emily. It appears as though the new Directory API has been drastically simplified compared to the old Provisioning API by simply utilizing the domain portion of the email addresses when referencing customers. That's great! – Corey Ballou Oct 17 '13 at 16:46
One more question... when creating the first user for a customer domain, will this user automatically be promoted to a super admin account? I'm wondering if it's necessary to make a follow-up request to `/makeAdmin`. – Corey Ballou Oct 17 '13 at 16:48
I believe you have to do the makeadmin call. The user wouldn't automatically become a superadmin even though she is the first user created. – Emily Oct 17 '13 at 16:49
Hi @Emily when the domains are booked by some other domain reseller, (1) how can we make give the reseller super admin access (2) The makeadmin api returns error . with whose email should i override it to call the same? – Ganesh RJ Sep 06 '16 at 05:38

As a reseller, how do I create a new Google Apps user using the Admin SDK Directory API?

1 Answers1