Google Admin Directory integration
Google Admin Directory integration for AI agents.
Google Admin Directory integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Google Admin Directory tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.
What your agents can do
Real Google Admin Directory actions, managed and audited.
Your user connects Google Admin Directory once; your agent can then secure AI-agent actions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.
- 1
Your user grants Google Admin Directory access once (OAuth) — the token lands in the vault.
- 2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
- 3
Every routed call appends a hash-chained audit record — nothing leaves your infra.
Tools & triggers
Supported Google Admin Directory tools.
125 tools are generated from the published Google Admin Directory catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.
Showing 125 tools. All published catalog entries are included in this page's server-rendered HTML.
- Admin Channels Stop
- Stops watching resources through this channel.
- channels
- Admin Customer Devices Chromeos BatchChangeStatus
- Changes the status of a batch of ChromeOS devices. For more information about changing a ChromeOS device state [Repair, repurpose, or retire ChromeOS devices](https://support.google.com/chrome/a/answer/3523633).
- customer
- Admin Customer Devices Chromeos Commands Get
- Gets command data a specific command issued to the device.
- customer
- Admin Customer Devices Chromeos CountChromeOsDevices
- Counts ChromeOS devices matching the request.
- customer
- Admin Customer Devices Chromeos IssueCommand
- Issues a command for the device to execute.
- customer
- Admin Customers Chrome PrintServers BatchCreatePrintServers
- Creates multiple print servers.
- customers
- Admin Customers Chrome PrintServers BatchDeletePrintServers
- Deletes multiple print servers.
- customers
- Admin Customers Chrome PrintServers Create
- Creates a print server.
- customers
- Admin Customers Chrome PrintServers Delete
- Deletes a print server.
- customers
- Admin Customers Chrome PrintServers Get
- Returns a print server's configuration.
- customers
- Admin Customers Chrome PrintServers List
- Lists print server configurations.
- customers
- Admin Customers Chrome PrintServers Patch
- Updates a print server's configuration.
- customers
- Admin Customers Chrome Printers BatchCreatePrinters
- Creates printers under given Organization Unit.
- customers
- Admin Customers Chrome Printers BatchDeletePrinters
- Deletes printers in batch.
- customers
- Admin Customers Chrome Printers Create
- Creates a printer under given Organization Unit.
- customers
- Admin Customers Chrome Printers List
- List printers configs.
- customers
- Admin Customers Chrome Printers ListPrinterModels
- Lists the supported printer models.
- customers
- Directory Asps Delete
- Deletes an ASP issued by a user.
- asps
- Directory Asps Get
- Gets information about an ASP issued by a user.
- asps
- Directory Asps List
- Lists the ASPs issued by a user.
- asps
- Directory Chromeosdevices Action
- Use [BatchChangeChromeOsDeviceStatus](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos/batchChangeStatus) instead. Takes an action that affects a Chrome OS Device. This includes deprovisioning, disabling, and re-enabling devices. *Warning:* * Deprovisioning a device will stop device policy syncing and remove device-level printers. After a device is deprovisioned, it must be wiped before it can be re-enrolled. * Lost or stolen devices should use the disable action. * Re-enabling a disabled device will consume a device license. If you do not have sufficient licenses available when completing the re-enable action, you will receive an error. For more information about deprovisioning and disabling devices, visit the [help center](https://support.google.com/chrome/a/answer/3523633).
- chromeosdevices
- Directory Chromeosdevices Get
- Retrieves a Chrome OS device's properties.
- chromeosdevices
- Directory Chromeosdevices List
- Retrieves a paginated list of Chrome OS devices within an account.
- chromeosdevices
- Directory Chromeosdevices MoveDevicesToOu
- Moves or inserts multiple Chrome OS devices to an organizational unit. You can move up to 50 devices at once.
- chromeosdevices
- Directory Chromeosdevices Patch
- Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`, or `annotatedAssetId`. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch).
- chromeosdevices
- Directory Chromeosdevices Update
- Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`, or `annotatedAssetId`.
- chromeosdevices
- Directory Customers Get
- Retrieves a customer.
- customers
- Directory Customers Patch
- Patches a customer.
- customers
- Directory Customers Update
- Updates a customer.
- customers
- Directory DomainAliases Delete
- Deletes a domain Alias of the customer.
- domainaliases
- Directory DomainAliases Get
- Retrieves a domain alias of the customer.
- domainaliases
- Directory DomainAliases Insert
- Inserts a domain alias of the customer.
- domainaliases
- Directory DomainAliases List
- Lists the domain aliases of the customer.
- domainaliases
- Directory Domains Delete
- Deletes a domain of the customer.
- domains
- Directory Domains Get
- Retrieves a domain of the customer.
- domains
- Directory Domains Insert
- Inserts a domain of the customer.
- domains
- Directory Domains List
- Lists the domains of the customer.
- domains
- Directory Groups Aliases Delete
- Removes an alias.
- groups
- Directory Groups Aliases Insert
- Adds an alias for the group.
- groups
- Directory Groups Aliases List
- Lists all aliases for a group.
- groups
- Directory Groups Delete
- Deletes a group.
- groups
- Directory Groups Get
- Retrieves a group's properties.
- groups
- Directory Groups Insert
- Creates a group.
- groups
- Directory Groups List
- Retrieves all groups of a domain or of a user given a userKey (paginated).
- groups
- Directory Groups Patch
- Updates a group's properties. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch).
- groups
- Directory Groups Update
- Updates a group's properties.
- groups
- Directory Members Delete
- Removes a member from a group.
- members
- Directory Members Get
- Retrieves a group member's properties.
- members
- Directory Members HasMember
- Checks whether the given user is a member of the group. Membership can be direct or nested, but if nested, the `memberKey` and `groupKey` must be entities in the same domain or an `Invalid input` error is returned. To check for nested memberships that include entities outside of the group's domain, use the [`checkTransitiveMembership()`](https://cloud.google.com/identity/docs/reference/rest/v1/groups.memberships/checkTransitiveMembership) method in the Cloud Identity Groups API.
- members
- Directory Members Insert
- Adds a user to the specified group.
- members
- Directory Members List
- Retrieves a paginated list of all members in a group. This method times out after 60 minutes. For more information, see [Troubleshoot error codes](https://developers.google.com/workspace/admin/directory/v1/guides/troubleshoot-error-codes).
- members
- Directory Members Patch
- Updates the membership properties of a user in the specified group. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch).
- members
- Directory Members Update
- Updates the membership of a user in the specified group.
- members
- Directory Mobiledevices Action
- Takes an action that affects a mobile device. For example, remotely wiping a device.
- mobiledevices
- Directory Mobiledevices Delete
- Removes a mobile device.
- mobiledevices
- Directory Mobiledevices Get
- Retrieves a mobile device's properties.
- mobiledevices
- Directory Mobiledevices List
- Retrieves a paginated list of all user-owned mobile devices for an account. To retrieve a list that includes company-owned devices, use the Cloud Identity [Devices API](https://cloud.google.com/identity/docs/concepts/overview-devices) instead. This method times out after 60 minutes. For more information, see [Troubleshoot error codes](https://developers.google.com/workspace/admin/directory/v1/guides/troubleshoot-error-codes).
- mobiledevices
- Directory Orgunits Delete
- Removes an organizational unit.
- orgunits
- Directory Orgunits Get
- Retrieves an organizational unit.
- orgunits
- Directory Orgunits Insert
- Adds an organizational unit.
- orgunits
- Directory Orgunits List
- Retrieves a list of all organizational units for an account.
- orgunits
- Directory Orgunits Patch
- Updates an organizational unit. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch)
- orgunits
- Directory Orgunits Update
- Updates an organizational unit.
- orgunits
- Directory Privileges List
- Retrieves a paginated list of all privileges for a customer.
- privileges
- Directory Resources Buildings Delete
- Deletes a building.
- resources
- Directory Resources Buildings Get
- Retrieves a building.
- resources
- Directory Resources Buildings Insert
- Inserts a building.
- resources
- Directory Resources Buildings List
- Retrieves a list of buildings for an account.
- resources
- Directory Resources Buildings Patch
- Patches a building.
- resources
- Directory Resources Buildings Update
- Updates a building.
- resources
- Directory Resources Calendars Delete
- Deletes a calendar resource.
- resources
- Directory Resources Calendars Get
- Retrieves a calendar resource.
- resources
- Directory Resources Calendars Insert
- Inserts a calendar resource.
- resources
- Directory Resources Calendars List
- Retrieves a list of calendar resources for an account.
- resources
- Directory Resources Calendars Patch
- Patches a calendar resource.
- resources
- Directory Resources Calendars Update
- Updates a calendar resource. This method supports patch semantics, meaning you only need to include the fields you wish to update. Fields that are not present in the request will be preserved.
- resources
- Directory Resources Features Delete
- Deletes a feature.
- resources
- Directory Resources Features Get
- Retrieves a feature.
- resources
- Directory Resources Features Insert
- Inserts a feature.
- resources
- Directory Resources Features List
- Retrieves a list of features for an account.
- resources
- Directory Resources Features Patch
- Patches a feature.
- resources
- Directory Resources Features Rename
- Renames a feature.
- resources
- Directory Resources Features Update
- Updates a feature.
- resources
- Directory RoleAssignments Delete
- Deletes a role assignment.
- roleassignments
- Directory RoleAssignments Get
- Retrieves a role assignment.
- roleassignments
- Directory RoleAssignments Insert
- Creates a role assignment.
- roleassignments
- Directory RoleAssignments List
- Retrieves a paginated list of all roleAssignments.
- roleassignments
- Directory Roles Delete
- Deletes a role.
- roles
- Directory Roles Get
- Retrieves a role.
- roles
- Directory Roles Insert
- Creates a role.
- roles
- Directory Roles List
- Retrieves a paginated list of all the roles in a domain.
- roles
- Directory Roles Patch
- Patches a role.
- roles
- Directory Roles Update
- Updates a role.
- roles
- Directory Schemas Delete
- Deletes a schema.
- schemas
- Directory Schemas Get
- Retrieves a schema.
- schemas
- Directory Schemas Insert
- Creates a schema.
- schemas
- Directory Schemas List
- Retrieves all schemas for a customer.
- schemas
- Directory Schemas Patch
- Patches a schema.
- schemas
- Directory Schemas Update
- Updates a schema.
- schemas
- Directory Tokens Delete
- Deletes all access tokens issued by a user for an application.
- tokens
- Directory Tokens Get
- Gets information about an access token issued by a user.
- tokens
- Directory Tokens List
- Returns the set of tokens specified user has issued to 3rd party applications.
- tokens
- Directory TwoStepVerification TurnOff
- Turns off 2-Step Verification for user.
- twostepverification
- Directory Users Aliases Delete
- Removes an alias.
- users
- Directory Users Aliases Insert
- Adds an alias.
- users
- Directory Users Aliases List
- Lists all aliases for a user.
- users
- Directory Users Aliases Watch
- Watches for changes in users list.
- users
- Directory Users CreateGuest
- Create a guest user with access to a [subset of Workspace capabilities](https://support.google.com/a/answer/16558545). This feature is currently in Open Beta.
- users
- Directory Users Delete
- Deletes a user.
- users
- Directory Users Get
- Retrieves a user.
- users
- Directory Users Insert
- Creates a user. Mutate calls immediately following user creation might sometimes fail as the user isn't fully created due to propagation delay in our backends. Check the error details for the "User creation is not complete" message to see if this is the case. Retrying the calls after some time can help in this case. If `resolveConflictAccount` is set to `true`, a `202` response code means that a conflicting unmanaged account exists and was invited to join the organization. A `409` response code means that a conflicting account exists so the user wasn't created based on the [handling unmanaged user accounts](https://support.google.com/a/answer/11112794) option selected.
- users
- Directory Users List
- Retrieves a paginated list of either deleted users or all users in a domain.
- users
- Directory Users MakeAdmin
- Makes a user a super administrator.
- users
- Directory Users Patch
- Updates a user using patch semantics. The update method should be used instead, because it also supports patch semantics and has better performance. If you're mapping an external identity to a Google identity, use the [`update`](https://developers.google.com/workspace/admin/directory/v1/reference/users/update) method instead of the `patch` method. This method is unable to clear fields that contain repeated objects (`addresses`, `phones`, etc). Use the update method instead.
- users
- Directory Users Photos Delete
- Removes the user's photo.
- users
- Directory Users Photos Get
- Retrieves the user's photo.
- users
- Directory Users Photos Patch
- Adds a photo for the user. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch).
- users
- Directory Users Photos Update
- Adds a photo for the user.
- users
- Directory Users SignOut
- Signs a user out of all web and device sessions and reset their sign-in cookies. User will have to sign in by authenticating again.
- users
- Directory Users Undelete
- Undeletes a deleted user.
- users
- Directory Users Update
- Updates a user. This method supports patch semantics, meaning that you only need to include the fields you wish to update. Fields that are not present in the request will be preserved, and fields set to `null` will be cleared. For repeating fields that contain arrays, individual items in the array can't be patched piecemeal; they must be supplied in the request body with the desired values for all items. See the [user accounts guide](https://developers.google.com/workspace/admin/directory/v1/guides/manage-users#update_user) for more information.
- users
- Directory Users Watch
- Watches for changes in users list.
- users
- Directory VerificationCodes Generate
- Generates new backup verification codes for the user.
- verificationcodes
- Directory VerificationCodes Invalidate
- Invalidates the current backup verification codes for the user.
- verificationcodes
- Directory VerificationCodes List
- Returns the current set of valid backup verification codes for the specified user.
- verificationcodes
FAQ
Google Admin Directory integration, answered
- How do AI agents use Google Admin Directory through Open Connector?
- Your user connects Google Admin Directory once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Google Admin Directory tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
- Is this a Google Admin Directory MCP server?
- Yes. Open Connector can serve Google Admin Directory as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Google Admin Directory actions with credentials injected server-side.
- Where do Google Admin Directory credentials live?
- In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.
Give your agents Google Admin Directory — keep the keys.
Open source, self-hostable, with Google Admin Directory credentials that never leave your infrastructure. Run it from source today.