;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubManage users, groups and org units and read audit logs of a Google Workspace domain from any Windmill script, flow or app.
Set up in 2 steps
Connect from the Resources page
Open Resources, click Add a resource/API and pick gworkspace under Instance-configured OAuth APIs. Click Connect and sign in with a Workspace admin account, then name the resource and save it.
Run your first script
Fork any script below and read before writing anything.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
List Activities
Update User
Suspend or Unsuspend User
Reset User Password
Remove Group Member
Move User to Org Unit
List Users
List Org Units
List Groups
List Group Members
Get User
Get Access Token (Service Account)
Delete User
Create User
Create Group
Add Group Member
Google native trigger template script
Flows
Multi-step workflows that already wire Google Workspace to something else.
Resource type
The shape of the credential every script on this page expects.
gworkspace
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| token | string | Yes | OAuth token |
Questions
What can Windmill do with my account?
It acts through the Admin Directory API, so it can read and change directory objects across the domain. Connect an account with the admin rights you intend, and no more.
Can scheduled flows run without an admin's OAuth session?
Yes, and for shared or scheduled flows that is the better lane: a connected resource acts as the admin who signed in and stops working if they leave. Store a service account key as a gcp_service_account resource and, in Admin console > Security > API controls > Domain-wide delegation, authorize its client ID for the admin.directory scopes (plus admin.reports.audit.readonly for audit logs). In a flow, run Get Access Token (Service Account) with an admin's email first and pass its result as the Google Workspace resource of the next steps.
Which scopes does the connection need?
The default connection grants admin.directory.user, .group, .orgunit and .user.security, which covers every script but List Activities. That one reads audit logs and needs admin.reports.audit.readonly, which you tick when connecting.
There is no Connect button on my instance
An instance admin has to add a Google OAuth client once, in Instance settings → Auth/OAuth/SAML → OAuth. Until then gworkspace is missing from the Instance-configured OAuth APIs list. A service account (above) works without it.