OAuth Scopes and Endpoints

Required Scopes and Endpoint Domains for Google Directory

When integrating with Google Directory, your application needs specific permissions to interact with the API.

These permissions are defined by access scopes, which determine what data your application can access and what actions it can perform.

This topic provides information about the required access scopes and endpoint domains for the Google Directory server.

Understanding Scopes

Scopes are a way to limit an application's access to a user's data. They define the specific actions that an application can perform on behalf of the user.

For example, a read-only scope might allow an application to view data, while a full access scope might allow it to modify data.

Required Scopes for Google Directory


Scope	Description
googleapis.com/auth/admin.directory.resource.calendar.readonly	Read-only access to calendar resources.
googleapis.com/auth/admin.directory.domain.readonly	Read-only access to domains associated with the account.
googleapis.com/auth/admin.directory.customer.readonly	Read-only access to customer information.
googleapis.com/auth/admin.directory.userschema.readonly	Read-only access to user schemas.
googleapis.com/auth/admin.directory.rolemanagement.readonly	Read-only access to roles and role assignments.
googleapis.com/auth/admin.directory.user.alias.readonly	Read-only access to user aliases.
googleapis.com/auth/admin.directory.user.readonly	Read-only access to user information.
googleapis.com/auth/admin.directory.orgunit.readonly	Read-only access to organizational unit structure.
googleapis.com/auth/admin.directory.group.readonly	Read-only access to groups.
googleapis.com/auth/admin.directory.group.member.readonly	Read-only access to group members.
googleapis.com/auth/admin.directory.device.mobile.readonly	Read-only access to mobile device information.
googleapis.com/auth/admin.directory.device.chromeos.readonly	Read-only access to ChromeOS device information.
googleapis.com/auth/admin.directory.resource.calendar	Full access to manage calendar resources.
googleapis.com/auth/admin.directory.domain	Full access to manage domains.
googleapis.com/auth/admin.directory.customer	Full access to manage customer information.
googleapis.com/auth/admin.directory.userschema	Full access to manage user schemas.
googleapis.com/auth/admin.directory.rolemanagement	Full access to manage roles and role assignments.
googleapis.com/auth/admin.directory.user.alias	Full access to manage user aliases.
googleapis.com/auth/admin.directory.user	Full access to manage users.
googleapis.com/auth/admin.directory.orgunit	Full access to manage organizational units.
googleapis.com/auth/admin.directory.group	Full access to manage groups.
googleapis.com/auth/admin.directory.group.member	Full access to manage group members.
googleapis.com/auth/admin.directory.device.mobile	Full access to manage mobile devices.
googleapis.com/auth/admin.directory.device.chromeos	Full access to manage ChromeOS devices.

Understanding Endpoint Domains

Endpoint domains are the specific URLs that the application needs to communicate with in order to authenticate, retrieve records, and perform other essential operations.

Allowlisting these domains ensures that the network traffic between your application and the API is not blocked by firewalls or security settings.

Note: Most users do not need to make any special configurations. Allowlisting is typically only necessary for environments with strict security measures, such as restricted outbound network traffic.

Required Endpoint Domains for Google Directory