users

Creates, updates, deletes, gets or lists a users resource.

Overview

Name	users
Type	Resource
Id	googleadmin.directory.users

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	The unique ID for the user. A user id can be used as a user request URI's userKey.
name	object	Holds the given and family names of the user, and the read-only fullName value. The maximum number of characters in the givenName and in the familyName values is 60. In addition, name values support unicode/UTF-8 characters, and can contain spaces, letters (a-z), numbers (0-9), dashes (-), forward slashes (/), and periods (.). For more information about character usage rules, see the administration help center. Maximum allowed data size for this field is 1KB. (id: UserName)
addresses	any	The list of the user's addresses. The maximum allowed data size for this field is 10KB.
agreedToTerms	boolean	Output only. This property is true if the user has completed an initial login and accepted the Terms of Service agreement.
aliases	array	Output only. The list of the user's alias email addresses.
archivalTime	string	Output only. User's account archival time. (Read-only)
archived	boolean	Indicates if user is archived.
changePasswordAtNextLogin	boolean	Indicates if the user is forced to change their password at next login. This setting doesn't apply when the user signs in via a third-party identity provider.
creationTime	string (date-time)	User's G Suite account creation time. (Read-only)
customSchemas	object	Custom fields of the user. The key is a schema_name and its values are 'field_name': 'field_value'.
customerId	string	Output only. The customer ID to retrieve all account users. You can use the alias my_customer to represent your account's customerId. As a reseller administrator, you can use the resold customer account's customerId. To get a customerId, use the account's primary domain in the domain parameter of a users.list request.
deletionTime	string (date-time)
emails	any	The list of the user's email addresses. The maximum allowed data size for this field is 10KB. This excludes publicKeyEncryptionCertificates.
etag	string	Output only. ETag of the resource.
externalIds	any	The list of external IDs for the user, such as an employee or network ID. The maximum allowed data size for this field is 2KB.
gender	any	The user's gender. The maximum allowed data size for this field is 1KB.
guestAccountInfo	object	Immutable. Additional guest-related metadata fields (id: GuestAccountInfo)
hashFunction	string	Stores the hash format of the password property. The following hashFunction values are allowed: * MD5 - Accepts simple hex-encoded values. * SHA-1 - Accepts simple hex-encoded values. * crypt - Compliant with the C crypt library. Supports the DES, MD5 (hash prefix $1$), SHA-256 (hash prefix $5$), and SHA-512 (hash prefix $6$) hash algorithms. If rounds are specified as part of the prefix, they must be 10,000 or fewer.
ims	any	The list of the user's Instant Messenger (IM) accounts. A user account can have multiple ims properties. But, only one of these ims properties can be the primary IM contact. The maximum allowed data size for this field is 2KB.
includeInGlobalAddressList	boolean	Indicates if the user's profile is visible in the Google Workspace global address list when the contact sharing feature is enabled for the domain. For more information about excluding user profiles, see the administration help center.
ipWhitelisted	boolean	If true, the user's IP address is subject to a deprecated IP address allowlist configuration.
isAdmin	boolean	Output only. Indicates a user with super administrator privileges. The isAdmin property can only be edited in the Make a user an administrator operation ( makeAdmin method). If edited in the user insert or update methods, the edit is ignored by the API service.
isDelegatedAdmin	boolean	Output only. Indicates if the user is a delegated administrator. Delegated administrators are supported by the API but cannot create or undelete users, or make users administrators. These requests are ignored by the API service. Roles and privileges for administrators are assigned using the Admin console.
isEnforcedIn2Sv	boolean	Output only. Is 2-step verification enforced (Read-only)
isEnrolledIn2Sv	boolean	Output only. Is enrolled in 2-step verification (Read-only)
isGuestUser	boolean	Immutable. Indicates if the inserted user is a guest.
isMailboxSetup	boolean	Output only. Indicates if the user's Google mailbox is created. This property is only applicable if the user has been assigned a Gmail license.
keywords	any	The list of the user's keywords. The maximum allowed data size for this field is 1KB.
kind	string	Output only. The type of the API resource. For Users resources, the value is admin#directory#user. (default: admin#directory#user)
languages	any	The user's languages. The maximum allowed data size for this field is 1KB.
lastLoginTime	string (date-time)	User's last login time. (Read-only)
locations	any	The user's locations. The maximum allowed data size for this field is 10KB.
nonEditableAliases	array	Output only. The list of the user's non-editable alias email addresses. These are typically outside the account's primary domain or sub-domain.
notes	any	Notes for the user.
orgUnitPath	string	The full path of the parent organization associated with the user. If the parent organization is the top-level, it is represented as a forward slash (/).
organizations	any	The list of organizations the user belongs to. The maximum allowed data size for this field is 10KB.
password	string	User's password
phones	any	The list of the user's phone numbers. The maximum allowed data size for this field is 1KB.
posixAccounts	any	The list of POSIX account information for the user.
primaryEmail	string	The user's primary email address. This property is required in a request to create a user account. The primaryEmail must be unique and cannot be an alias of another user.
recoveryEmail	string	Recovery email of the user.
recoveryPhone	string	Recovery phone of the user. The phone number must be in the E.164 format, starting with the plus sign (+). Example: +16506661212.
relations	any	The list of the user's relationships to other users. The maximum allowed data size for this field is 2KB.
sshPublicKeys	any	A list of SSH public keys.
suspended	boolean	Indicates if user is suspended.
suspensionReason	string	Output only. Has the reason a user account is suspended either by the administrator or by Google at the time of suspension. The property is returned only if the suspended property is true.
suspensionTime	string	Output only. User's account suspension time. (Read-only)
thumbnailPhotoEtag	string	Output only. ETag of the user's photo (Read-only)
thumbnailPhotoUrl	string	Output only. The URL of the user's profile photo. The URL might be temporary or private.
websites	any	The user's websites. The maximum allowed data size for this field is 2KB.

list

Name	Datatype	Description
id	string	The unique ID for the user. A user id can be used as a user request URI's userKey.
name	object	Holds the given and family names of the user, and the read-only fullName value. The maximum number of characters in the givenName and in the familyName values is 60. In addition, name values support unicode/UTF-8 characters, and can contain spaces, letters (a-z), numbers (0-9), dashes (-), forward slashes (/), and periods (.). For more information about character usage rules, see the administration help center. Maximum allowed data size for this field is 1KB. (id: UserName)
addresses	any	The list of the user's addresses. The maximum allowed data size for this field is 10KB.
agreedToTerms	boolean	Output only. This property is true if the user has completed an initial login and accepted the Terms of Service agreement.
aliases	array	Output only. The list of the user's alias email addresses.
archivalTime	string	Output only. User's account archival time. (Read-only)
archived	boolean	Indicates if user is archived.
changePasswordAtNextLogin	boolean	Indicates if the user is forced to change their password at next login. This setting doesn't apply when the user signs in via a third-party identity provider.
creationTime	string (date-time)	User's G Suite account creation time. (Read-only)
customSchemas	object	Custom fields of the user. The key is a schema_name and its values are 'field_name': 'field_value'.
customerId	string	Output only. The customer ID to retrieve all account users. You can use the alias my_customer to represent your account's customerId. As a reseller administrator, you can use the resold customer account's customerId. To get a customerId, use the account's primary domain in the domain parameter of a users.list request.
deletionTime	string (date-time)
emails	any	The list of the user's email addresses. The maximum allowed data size for this field is 10KB. This excludes publicKeyEncryptionCertificates.
etag	string	Output only. ETag of the resource.
externalIds	any	The list of external IDs for the user, such as an employee or network ID. The maximum allowed data size for this field is 2KB.
gender	any	The user's gender. The maximum allowed data size for this field is 1KB.
guestAccountInfo	object	Immutable. Additional guest-related metadata fields (id: GuestAccountInfo)
hashFunction	string	Stores the hash format of the password property. The following hashFunction values are allowed: * MD5 - Accepts simple hex-encoded values. * SHA-1 - Accepts simple hex-encoded values. * crypt - Compliant with the C crypt library. Supports the DES, MD5 (hash prefix $1$), SHA-256 (hash prefix $5$), and SHA-512 (hash prefix $6$) hash algorithms. If rounds are specified as part of the prefix, they must be 10,000 or fewer.
ims	any	The list of the user's Instant Messenger (IM) accounts. A user account can have multiple ims properties. But, only one of these ims properties can be the primary IM contact. The maximum allowed data size for this field is 2KB.
includeInGlobalAddressList	boolean	Indicates if the user's profile is visible in the Google Workspace global address list when the contact sharing feature is enabled for the domain. For more information about excluding user profiles, see the administration help center.
ipWhitelisted	boolean	If true, the user's IP address is subject to a deprecated IP address allowlist configuration.
isAdmin	boolean	Output only. Indicates a user with super administrator privileges. The isAdmin property can only be edited in the Make a user an administrator operation ( makeAdmin method). If edited in the user insert or update methods, the edit is ignored by the API service.
isDelegatedAdmin	boolean	Output only. Indicates if the user is a delegated administrator. Delegated administrators are supported by the API but cannot create or undelete users, or make users administrators. These requests are ignored by the API service. Roles and privileges for administrators are assigned using the Admin console.
isEnforcedIn2Sv	boolean	Output only. Is 2-step verification enforced (Read-only)
isEnrolledIn2Sv	boolean	Output only. Is enrolled in 2-step verification (Read-only)
isGuestUser	boolean	Immutable. Indicates if the inserted user is a guest.
isMailboxSetup	boolean	Output only. Indicates if the user's Google mailbox is created. This property is only applicable if the user has been assigned a Gmail license.
keywords	any	The list of the user's keywords. The maximum allowed data size for this field is 1KB.
kind	string	Output only. The type of the API resource. For Users resources, the value is admin#directory#user. (default: admin#directory#user)
languages	any	The user's languages. The maximum allowed data size for this field is 1KB.
lastLoginTime	string (date-time)	User's last login time. (Read-only)
locations	any	The user's locations. The maximum allowed data size for this field is 10KB.
nonEditableAliases	array	Output only. The list of the user's non-editable alias email addresses. These are typically outside the account's primary domain or sub-domain.
notes	any	Notes for the user.
orgUnitPath	string	The full path of the parent organization associated with the user. If the parent organization is the top-level, it is represented as a forward slash (/).
organizations	any	The list of organizations the user belongs to. The maximum allowed data size for this field is 10KB.
password	string	User's password
phones	any	The list of the user's phone numbers. The maximum allowed data size for this field is 1KB.
posixAccounts	any	The list of POSIX account information for the user.
primaryEmail	string	The user's primary email address. This property is required in a request to create a user account. The primaryEmail must be unique and cannot be an alias of another user.
recoveryEmail	string	Recovery email of the user.
recoveryPhone	string	Recovery phone of the user. The phone number must be in the E.164 format, starting with the plus sign (+). Example: +16506661212.
relations	any	The list of the user's relationships to other users. The maximum allowed data size for this field is 2KB.
sshPublicKeys	any	A list of SSH public keys.
suspended	boolean	Indicates if user is suspended.
suspensionReason	string	Output only. Has the reason a user account is suspended either by the administrator or by Google at the time of suspension. The property is returned only if the suspended property is true.
suspensionTime	string	Output only. User's account suspension time. (Read-only)
thumbnailPhotoEtag	string	Output only. ETag of the user's photo (Read-only)
thumbnailPhotoUrl	string	Output only. The URL of the user's profile photo. The URL might be temporary or private.
websites	any	The user's websites. The maximum allowed data size for this field is 2KB.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	userKey	customFieldMask, projection, viewType	Retrieves a user.
list	select	domain	sortOrder, orderBy, showDeleted, pageToken, maxResults, projection, viewType, event, customFieldMask, customer, query	Retrieves a paginated list of either deleted users or all users in a domain.
insert	insert		resolveConflictAccount	Creates a user. Mutate calls immediately following user creation might sometimes fail as the user isn't fully created due to propagation delay in our backends. Check the error details for the "User creation is not complete" message to see if this is the case. Retrying the calls after some time can help in this case. If resolveConflictAccount is set to true, a 202 response code means that a conflicting unmanaged account exists and was invited to join the organization. A 409 response code means that a conflicting account exists so the user wasn't created based on the handling unmanaged user accounts option selected.
patch	update	userKey		Updates a user using patch semantics. The update method should be used instead, because it also supports patch semantics and has better performance. If you're mapping an external identity to a Google identity, use the update method instead of the patch method. This method is unable to clear fields that contain repeated objects (addresses, phones, etc). Use the update method instead.
update	replace	userKey		Updates a user. This method supports patch semantics, meaning that you only need to include the fields you wish to update. Fields that are not present in the request will be preserved, and fields set to null will be cleared. For repeating fields that contain arrays, individual items in the array can't be patched piecemeal; they must be supplied in the request body with the desired values for all items. See the user accounts guide for more information.
delete	delete	userKey		Deletes a user.
sign_out	exec	userKey		Signs a user out of all web and device sessions and reset their sign-in cookies. User will have to sign in by authenticating again.
undelete	exec	userKey		Undeletes a deleted user.
watch	exec		sortOrder, domain, orderBy, showDeleted, pageToken, maxResults, event, projection, viewType, customer, customFieldMask, query	Watches for changes in users list.
make_admin	exec	userKey		Makes a user a super administrator.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
domain	string
userKey	string
customFieldMask	string
customer	string
domain	string
event	string
maxResults	integer (int32)
orderBy	string
pageToken	string
projection	string
query	string
resolveConflictAccount	boolean
showDeleted	string
sortOrder	string
viewType	string

SELECT examples

get

Retrieves a user.

SELECT
id,
name,
addresses,
agreedToTerms,
aliases,
archivalTime,
archived,
changePasswordAtNextLogin,
creationTime,
customSchemas,
customerId,
deletionTime,
emails,
etag,
externalIds,
gender,
guestAccountInfo,
hashFunction,
ims,
includeInGlobalAddressList,
ipWhitelisted,
isAdmin,
isDelegatedAdmin,
isEnforcedIn2Sv,
isEnrolledIn2Sv,
isGuestUser,
isMailboxSetup,
keywords,
kind,
languages,
lastLoginTime,
locations,
nonEditableAliases,
notes,
orgUnitPath,
organizations,
password,
phones,
posixAccounts,
primaryEmail,
recoveryEmail,
recoveryPhone,
relations,
sshPublicKeys,
suspended,
suspensionReason,
suspensionTime,
thumbnailPhotoEtag,
thumbnailPhotoUrl,
websites
FROM googleadmin.directory.users
WHERE userKey = '{{ userKey }}' -- required
AND customFieldMask = '{{ customFieldMask }}'
AND projection = '{{ projection }}'
AND viewType = '{{ viewType }}'
;

list

Retrieves a paginated list of either deleted users or all users in a domain.

SELECT
id,
name,
addresses,
agreedToTerms,
aliases,
archivalTime,
archived,
changePasswordAtNextLogin,
creationTime,
customSchemas,
customerId,
deletionTime,
emails,
etag,
externalIds,
gender,
guestAccountInfo,
hashFunction,
ims,
includeInGlobalAddressList,
ipWhitelisted,
isAdmin,
isDelegatedAdmin,
isEnforcedIn2Sv,
isEnrolledIn2Sv,
isGuestUser,
isMailboxSetup,
keywords,
kind,
languages,
lastLoginTime,
locations,
nonEditableAliases,
notes,
orgUnitPath,
organizations,
password,
phones,
posixAccounts,
primaryEmail,
recoveryEmail,
recoveryPhone,
relations,
sshPublicKeys,
suspended,
suspensionReason,
suspensionTime,
thumbnailPhotoEtag,
thumbnailPhotoUrl,
websites
FROM googleadmin.directory.users
WHERE domain = '{{ domain }}' -- required
AND sortOrder = '{{ sortOrder }}'
AND orderBy = '{{ orderBy }}'
AND showDeleted = '{{ showDeleted }}'
AND pageToken = '{{ pageToken }}'
AND maxResults = '{{ maxResults }}'
AND projection = '{{ projection }}'
AND viewType = '{{ viewType }}'
AND event = '{{ event }}'
AND customFieldMask = '{{ customFieldMask }}'
AND customer = '{{ customer }}'
AND query = '{{ query }}'
;

INSERT examples

insert

Creates a user. Mutate calls immediately following user creation might sometimes fail as the user isn't fully created due to propagation delay in our backends. Check the error details for the "User creation is not complete" message to see if this is the case. Retrying the calls after some time can help in this case. If resolveConflictAccount is set to true, a 202 response code means that a conflicting unmanaged account exists and was invited to join the organization. A 409 response code means that a conflicting account exists so the user wasn't created based on the handling unmanaged user accounts option selected.

INSERT INTO googleadmin.directory.users (
data__locations,
data__ipWhitelisted,
data__guestAccountInfo,
data__includeInGlobalAddressList,
data__orgUnitPath,
data__recoveryPhone,
data__sshPublicKeys,
data__name,
data__addresses,
data__ims,
data__password,
data__notes,
data__emails,
data__id,
data__primaryEmail,
data__customSchemas,
data__archived,
data__externalIds,
data__organizations,
data__recoveryEmail,
data__hashFunction,
data__gender,
data__phones,
data__isGuestUser,
data__relations,
data__languages,
data__suspended,
data__websites,
data__keywords,
data__posixAccounts,
data__changePasswordAtNextLogin,
resolveConflictAccount
)
SELECT 
'{{ locations }}',
{{ ipWhitelisted }},
'{{ guestAccountInfo }}',
{{ includeInGlobalAddressList }},
'{{ orgUnitPath }}',
'{{ recoveryPhone }}',
'{{ sshPublicKeys }}',
'{{ name }}',
'{{ addresses }}',
'{{ ims }}',
'{{ password }}',
'{{ notes }}',
'{{ emails }}',
'{{ id }}',
'{{ primaryEmail }}',
'{{ customSchemas }}',
{{ archived }},
'{{ externalIds }}',
'{{ organizations }}',
'{{ recoveryEmail }}',
'{{ hashFunction }}',
'{{ gender }}',
'{{ phones }}',
{{ isGuestUser }},
'{{ relations }}',
'{{ languages }}',
{{ suspended }},
'{{ websites }}',
'{{ keywords }}',
'{{ posixAccounts }}',
{{ changePasswordAtNextLogin }},
'{{ resolveConflictAccount }}'
RETURNING
id,
name,
addresses,
agreedToTerms,
aliases,
archivalTime,
archived,
changePasswordAtNextLogin,
creationTime,
customSchemas,
customerId,
deletionTime,
emails,
etag,
externalIds,
gender,
guestAccountInfo,
hashFunction,
ims,
includeInGlobalAddressList,
ipWhitelisted,
isAdmin,
isDelegatedAdmin,
isEnforcedIn2Sv,
isEnrolledIn2Sv,
isGuestUser,
isMailboxSetup,
keywords,
kind,
languages,
lastLoginTime,
locations,
nonEditableAliases,
notes,
orgUnitPath,
organizations,
password,
phones,
posixAccounts,
primaryEmail,
recoveryEmail,
recoveryPhone,
relations,
sshPublicKeys,
suspended,
suspensionReason,
suspensionTime,
thumbnailPhotoEtag,
thumbnailPhotoUrl,
websites
;

Manifest

# Description fields are for documentation purposes
- name: users
props:
  - name: locations
    value: "{{ locations }}"
    description: |
      The user's locations. The maximum allowed data size for this field is 10KB.
  - name: ipWhitelisted
    value: {{ ipWhitelisted }}
    description: |
      If `true`, the user's IP address is subject to a deprecated IP address [`allowlist`](https://support.google.com/a/answer/60752) configuration.
  - name: guestAccountInfo
    description: |
      Immutable. Additional guest-related metadata fields
    value:
      primaryGuestEmail: "{{ primaryGuestEmail }}"
  - name: includeInGlobalAddressList
    value: {{ includeInGlobalAddressList }}
    description: |
      Indicates if the user's profile is visible in the Google Workspace global address list when the contact sharing feature is enabled for the domain. For more information about excluding user profiles, see the [administration help center](https://support.google.com/a/answer/1285988).
  - name: orgUnitPath
    value: "{{ orgUnitPath }}"
    description: |
      The full path of the parent organization associated with the user. If the parent organization is the top-level, it is represented as a forward slash (`/`).
  - name: recoveryPhone
    value: "{{ recoveryPhone }}"
    description: |
      Recovery phone of the user. The phone number must be in the E.164 format, starting with the plus sign (+). Example: *+16506661212*.
  - name: sshPublicKeys
    value: "{{ sshPublicKeys }}"
    description: |
      A list of SSH public keys.
  - name: name
    description: |
      Holds the given and family names of the user, and the read-only `fullName` value. The maximum number of characters in the `givenName` and in the `familyName` values is 60. In addition, name values support unicode/UTF-8 characters, and can contain spaces, letters (a-z), numbers (0-9), dashes (-), forward slashes (/), and periods (.). For more information about character usage rules, see the [administration help center](https://support.google.com/a/answer/9193374). Maximum allowed data size for this field is 1KB.
    value:
      displayName: "{{ displayName }}"
      fullName: "{{ fullName }}"
      familyName: "{{ familyName }}"
      givenName: "{{ givenName }}"
  - name: addresses
    value: "{{ addresses }}"
    description: |
      The list of the user's addresses. The maximum allowed data size for this field is 10KB.
  - name: ims
    value: "{{ ims }}"
    description: |
      The list of the user's Instant Messenger (IM) accounts. A user account can have multiple ims properties. But, only one of these ims properties can be the primary IM contact. The maximum allowed data size for this field is 2KB.
  - name: password
    value: "{{ password }}"
    description: |
      User's password
  - name: notes
    value: "{{ notes }}"
    description: |
      Notes for the user.
  - name: emails
    value: "{{ emails }}"
    description: |
      The list of the user's email addresses. The maximum allowed data size for this field is 10KB. This excludes `publicKeyEncryptionCertificates`.
  - name: id
    value: "{{ id }}"
    description: |
      The unique ID for the user. A user `id` can be used as a user request URI's `userKey`.
  - name: primaryEmail
    value: "{{ primaryEmail }}"
    description: |
      The user's primary email address. This property is required in a request to create a user account. The `primaryEmail` must be unique and cannot be an alias of another user.
  - name: customSchemas
    value: "{{ customSchemas }}"
    description: |
      Custom fields of the user. The key is a `schema_name` and its values are `'field_name': 'field_value'`.
  - name: archived
    value: {{ archived }}
    description: |
      Indicates if user is archived.
  - name: externalIds
    value: "{{ externalIds }}"
    description: |
      The list of external IDs for the user, such as an employee or network ID. The maximum allowed data size for this field is 2KB.
  - name: organizations
    value: "{{ organizations }}"
    description: |
      The list of organizations the user belongs to. The maximum allowed data size for this field is 10KB.
  - name: recoveryEmail
    value: "{{ recoveryEmail }}"
    description: |
      Recovery email of the user.
  - name: hashFunction
    value: "{{ hashFunction }}"
    description: |
      Stores the hash format of the `password` property. The following `hashFunction` values are allowed: * `MD5` - Accepts simple hex-encoded values. * `SHA-1` - Accepts simple hex-encoded values. * `crypt` - Compliant with the [C crypt library](https://en.wikipedia.org/wiki/Crypt_%28C%29). Supports the DES, MD5 (hash prefix `$1$`), SHA-256 (hash prefix `$5$`), and SHA-512 (hash prefix `$6$`) hash algorithms. If rounds are specified as part of the prefix, they must be 10,000 or fewer.
  - name: gender
    value: "{{ gender }}"
    description: |
      The user's gender. The maximum allowed data size for this field is 1KB.
  - name: phones
    value: "{{ phones }}"
    description: |
      The list of the user's phone numbers. The maximum allowed data size for this field is 1KB.
  - name: isGuestUser
    value: {{ isGuestUser }}
    description: |
      Immutable. Indicates if the inserted user is a guest.
  - name: relations
    value: "{{ relations }}"
    description: |
      The list of the user's relationships to other users. The maximum allowed data size for this field is 2KB.
  - name: languages
    value: "{{ languages }}"
    description: |
      The user's languages. The maximum allowed data size for this field is 1KB.
  - name: suspended
    value: {{ suspended }}
    description: |
      Indicates if user is suspended.
  - name: websites
    value: "{{ websites }}"
    description: |
      The user's websites. The maximum allowed data size for this field is 2KB.
  - name: keywords
    value: "{{ keywords }}"
    description: |
      The list of the user's keywords. The maximum allowed data size for this field is 1KB.
  - name: posixAccounts
    value: "{{ posixAccounts }}"
    description: |
      The list of [POSIX](https://www.opengroup.org/austin/papers/posix_faq.html) account information for the user.
  - name: changePasswordAtNextLogin
    value: {{ changePasswordAtNextLogin }}
    description: |
      Indicates if the user is forced to change their password at next login. This setting doesn't apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
  - name: resolveConflictAccount
    value: {{ resolveConflictAccount }}

UPDATE examples

patch

Updates a user using patch semantics. The update method should be used instead, because it also supports patch semantics and has better performance. If you're mapping an external identity to a Google identity, use the update method instead of the patch method. This method is unable to clear fields that contain repeated objects (addresses, phones, etc). Use the update method instead.

UPDATE googleadmin.directory.users
SET 
data__locations = '{{ locations }}',
data__ipWhitelisted = {{ ipWhitelisted }},
data__guestAccountInfo = '{{ guestAccountInfo }}',
data__includeInGlobalAddressList = {{ includeInGlobalAddressList }},
data__orgUnitPath = '{{ orgUnitPath }}',
data__recoveryPhone = '{{ recoveryPhone }}',
data__sshPublicKeys = '{{ sshPublicKeys }}',
data__name = '{{ name }}',
data__addresses = '{{ addresses }}',
data__ims = '{{ ims }}',
data__password = '{{ password }}',
data__notes = '{{ notes }}',
data__emails = '{{ emails }}',
data__id = '{{ id }}',
data__primaryEmail = '{{ primaryEmail }}',
data__customSchemas = '{{ customSchemas }}',
data__archived = {{ archived }},
data__externalIds = '{{ externalIds }}',
data__organizations = '{{ organizations }}',
data__recoveryEmail = '{{ recoveryEmail }}',
data__hashFunction = '{{ hashFunction }}',
data__gender = '{{ gender }}',
data__phones = '{{ phones }}',
data__isGuestUser = {{ isGuestUser }},
data__relations = '{{ relations }}',
data__languages = '{{ languages }}',
data__suspended = {{ suspended }},
data__websites = '{{ websites }}',
data__keywords = '{{ keywords }}',
data__posixAccounts = '{{ posixAccounts }}',
data__changePasswordAtNextLogin = {{ changePasswordAtNextLogin }}
WHERE 
userKey = '{{ userKey }}' --required
RETURNING
id,
name,
addresses,
agreedToTerms,
aliases,
archivalTime,
archived,
changePasswordAtNextLogin,
creationTime,
customSchemas,
customerId,
deletionTime,
emails,
etag,
externalIds,
gender,
guestAccountInfo,
hashFunction,
ims,
includeInGlobalAddressList,
ipWhitelisted,
isAdmin,
isDelegatedAdmin,
isEnforcedIn2Sv,
isEnrolledIn2Sv,
isGuestUser,
isMailboxSetup,
keywords,
kind,
languages,
lastLoginTime,
locations,
nonEditableAliases,
notes,
orgUnitPath,
organizations,
password,
phones,
posixAccounts,
primaryEmail,
recoveryEmail,
recoveryPhone,
relations,
sshPublicKeys,
suspended,
suspensionReason,
suspensionTime,
thumbnailPhotoEtag,
thumbnailPhotoUrl,
websites;

REPLACE examples

update

Updates a user. This method supports patch semantics, meaning that you only need to include the fields you wish to update. Fields that are not present in the request will be preserved, and fields set to null will be cleared. For repeating fields that contain arrays, individual items in the array can't be patched piecemeal; they must be supplied in the request body with the desired values for all items. See the user accounts guide for more information.

REPLACE googleadmin.directory.users
SET 
data__locations = '{{ locations }}',
data__ipWhitelisted = {{ ipWhitelisted }},
data__guestAccountInfo = '{{ guestAccountInfo }}',
data__includeInGlobalAddressList = {{ includeInGlobalAddressList }},
data__orgUnitPath = '{{ orgUnitPath }}',
data__recoveryPhone = '{{ recoveryPhone }}',
data__sshPublicKeys = '{{ sshPublicKeys }}',
data__name = '{{ name }}',
data__addresses = '{{ addresses }}',
data__ims = '{{ ims }}',
data__password = '{{ password }}',
data__notes = '{{ notes }}',
data__emails = '{{ emails }}',
data__id = '{{ id }}',
data__primaryEmail = '{{ primaryEmail }}',
data__customSchemas = '{{ customSchemas }}',
data__archived = {{ archived }},
data__externalIds = '{{ externalIds }}',
data__organizations = '{{ organizations }}',
data__recoveryEmail = '{{ recoveryEmail }}',
data__hashFunction = '{{ hashFunction }}',
data__gender = '{{ gender }}',
data__phones = '{{ phones }}',
data__isGuestUser = {{ isGuestUser }},
data__relations = '{{ relations }}',
data__languages = '{{ languages }}',
data__suspended = {{ suspended }},
data__websites = '{{ websites }}',
data__keywords = '{{ keywords }}',
data__posixAccounts = '{{ posixAccounts }}',
data__changePasswordAtNextLogin = {{ changePasswordAtNextLogin }}
WHERE 
userKey = '{{ userKey }}' --required
RETURNING
id,
name,
addresses,
agreedToTerms,
aliases,
archivalTime,
archived,
changePasswordAtNextLogin,
creationTime,
customSchemas,
customerId,
deletionTime,
emails,
etag,
externalIds,
gender,
guestAccountInfo,
hashFunction,
ims,
includeInGlobalAddressList,
ipWhitelisted,
isAdmin,
isDelegatedAdmin,
isEnforcedIn2Sv,
isEnrolledIn2Sv,
isGuestUser,
isMailboxSetup,
keywords,
kind,
languages,
lastLoginTime,
locations,
nonEditableAliases,
notes,
orgUnitPath,
organizations,
password,
phones,
posixAccounts,
primaryEmail,
recoveryEmail,
recoveryPhone,
relations,
sshPublicKeys,
suspended,
suspensionReason,
suspensionTime,
thumbnailPhotoEtag,
thumbnailPhotoUrl,
websites;

DELETE examples

delete

Deletes a user.

DELETE FROM googleadmin.directory.users
WHERE userKey = '{{ userKey }}' --required
;

Lifecycle Methods

sign_out

Signs a user out of all web and device sessions and reset their sign-in cookies. User will have to sign in by authenticating again.

EXEC googleadmin.directory.users.sign_out 
@userKey='{{ userKey }}' --required
;

undelete

Undeletes a deleted user.

EXEC googleadmin.directory.users.undelete 
@userKey='{{ userKey }}' --required 
@@json=
'{
"orgUnitPath": "{{ orgUnitPath }}"
}'
;

watch

Watches for changes in users list.

EXEC googleadmin.directory.users.watch 
@sortOrder='{{ sortOrder }}', 
@domain='{{ domain }}', 
@orderBy='{{ orderBy }}', 
@showDeleted='{{ showDeleted }}', 
@pageToken='{{ pageToken }}', 
@maxResults='{{ maxResults }}', 
@event='{{ event }}', 
@projection='{{ projection }}', 
@viewType='{{ viewType }}', 
@customer='{{ customer }}', 
@customFieldMask='{{ customFieldMask }}', 
@query='{{ query }}' 
@@json=
'{
"address": "{{ address }}", 
"token": "{{ token }}", 
"resourceId": "{{ resourceId }}", 
"params": "{{ params }}", 
"type": "{{ type }}", 
"kind": "{{ kind }}", 
"id": "{{ id }}", 
"resourceUri": "{{ resourceUri }}", 
"payload": {{ payload }}, 
"expiration": "{{ expiration }}"
}'
;

make_admin

Makes a user a super administrator.

EXEC googleadmin.directory.users.make_admin 
@userKey='{{ userKey }}' --required 
@@json=
'{
"status": {{ status }}
}'
;