Google Directory

Google Directory is a comprehensive data integration platform for Google Workspace (formerly G Suite) that provides access to organizational directory information, identity and access management (IAM) data, and administrative structures. This platform enables querying and monitoring of all users, groups, organizational units, domains, roles, privileges, and access assignments within a Google Workspace environment.

Category	Identity
Direction	Query source
Sign-in	Service Account (Domain-Wide Delegation), OAuth 2.0 Client Secret
Query languages	SQLite
Tables	9
Query templates	36
Website	google.com

Before you start

Huntbase can sign in to Google Directory with any of these methods: Service Account (Domain-Wide Delegation), OAuth 2.0 Client Secret. Pick one, create the credential in Google Directory, then keep it to hand for the Connect step.

Service Account (Domain-Wide Delegation)

Authenticate with a Google service-account credentials JSON file (or its contents) plus a user email to impersonate via domain-wide delegation.

1. In the Google Cloud console, go to IAM & Admin › Service Accounts, select your project and click Create service account. Enter a name and click Done.
2. Open the service account, go to the Keys tab, select Add key › Create new key, choose JSON and click Create.
3. On the service account, click Show advanced settings and copy the Client ID under Domain-wide delegation.
4. As a super admin in the Google Admin console, go to Security › Access and data control › API controls, click Manage Domain Wide Delegation › Add new, paste the Client ID, enter the read-only scopes below in OAuth Scopes, and click Authorize.

Permissions:

• https://www.googleapis.com/auth/admin.directory.domain.readonly
• https://www.googleapis.com/auth/admin.directory.group.readonly
• https://www.googleapis.com/auth/admin.directory.orgunit.readonly
• https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
• https://www.googleapis.com/auth/admin.directory.user.readonly

Watch out for

• Only a super admin can authorize domain-wide delegation.

For the vendor's own instructions, see Google Workspace domain-wide delegation documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Google Directory

1. Go to Connections and click New connection, or click New connection on the Google Directory product page.
2. On Product, pick Google Directory and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Google Directory lives:

Field	Required	Notes
Impersonated User Email	Yes	The email of a Google Workspace user with permission to access the Admin APIs. The service account acts as this user.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

Service Account (Domain-Wide Delegation)

Field	Required	Notes
Service Account Credentials	Yes	The full contents of the downloaded service account JSON key file. Secret — not shown again after you save it.

OAuth 2.0 Client Secret

Field	Required	Notes
OAuth Credentials File Path	Yes	Secret — not shown again after you save it.

Query it

Once connected, Google Directory can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 9 tables listed below, alongside every other connected source.

Example: SQLite

Google Directory domains basic info — List all domains in the Google Directory, showing whether each is a primary domain and when it was created.

select
  domain_name,
  creation_time,
  is_primary
from
  googledirectory_domain;

Google Directory ships with 36 query templates. Find them in Library › Queries — see Query templates.

What syncs automatically

Google Directory comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.

Query	Finds
Sync groups and members	group, user
Sync administrators	user
Sync users missing 2SV	user
Sync admin role assignments	user
Sync domains	domain

Tables

Google Directory adds 9 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 9 tables

Table	Contains
googledirectory_domain	Domains defined in the Google Workspace directory.
googledirectory_domain_alias	Domain alias defined in the Google Workspace directory.
googledirectory_group	Groups defined in the Google Workspace directory.
googledirectory_group_member	Group members defined in the Google Workspace directory.
googledirectory_org_unit	OrgUnits defined in the Google Workspace directory.
googledirectory_privilege	Privileges defined in the Google Workspace directory.
googledirectory_role	Roles defined in the Google Workspace directory.
googledirectory_role_assignment	Role assignments defined in the Google Workspace directory.
googledirectory_user	Users defined in the Google Workspace directory.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog