Cloud Identity API issue

Michael Moore

unread,

Apr 2, 2026, 11:22:37 AM (5 days ago) Apr 2

to GAM for Google Workspace

When I type gam print devices, I get an error that the API is not enabled.

If I try to update the serviceaccount, enabling Cloud Identity fails.

If I check the serviceaccount, it says the scope passes.

If I go in manually and add https://www.googleapis.com/auth/cloud-identity.devices.lookup as a scope on the admin console, I do not get the error.

Also, if I try to go to https://www.googleapis.com/auth/cloud-identity.devices in the web browser

Jay Lee

unread,

Apr 2, 2026, 12:14:08 PM (5 days ago) Apr 2

to google-ap...@googlegroups.com

Try running:

gam update project

And following the prompts there. Also show us the *exact* command you are running and error message you received.

Jay Lee

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/07f378c3-4264-44ae-8c1a-8c744720349en%40googlegroups.com.

Michael Moore

unread,

Apr 2, 2026, 2:45:39 PM (5 days ago) Apr 2

to GAM for Google Workspace

That seems to have worked to fix whatever was going on.

Initially I was simply typing gam print devices, to which the system would respond

Cloud Identity Devices API Service/App not enabled

C********************>gam update project

Enter your Google Workspace admin or GCP project manager email address authorized to manage project(s): ****************************

Go to the following link in a browser on this computer or on another computer:

*************************

If you use a browser on another computer, you will get a browser error that the site can't be reached AFTER you
click the Allow button, paste "Unable to connect" URL from other computer (only URL data up to &scope required):

Enter verification code or paste "Unable to connect" URL from other computer (only URL data up to &scope required): 127.0.0.1 - - [02/Apr/2026 13:19:08] "GET /?state=****************** HTTP/1.1" 200 91

The authentication flow has completed.
User: *******************, Update 1 Project
Project: *******************, Check 37 APIs
API: accesscontextmanager.googleapis.com, Already enabled (1/37)
API: admin.googleapis.com, Already enabled (2/37)
API: alertcenter.googleapis.com, Already enabled (3/37)
API: analytics.googleapis.com, Already enabled (non-GAM which is fine) (4/37)
API: analyticsadmin.googleapis.com, Already enabled (5/37)
API: calendar-json.googleapis.com, Already enabled (6/37)
API: chat.googleapis.com, Already enabled (7/37)
API: chromemanagement.googleapis.com, Already enabled (8/37)
API: chromepolicy.googleapis.com, Already enabled (9/37)
API: classroom.googleapis.com, Already enabled (10/37)
API: cloudchannel.googleapis.com, Already enabled (11/37)
API: cloudidentity.googleapis.com, Already enabled (12/37)
API: cloudresourcemanager.googleapis.com, Already enabled (13/37)
API: contacts.googleapis.com, Already enabled (14/37)
API: datastudio.googleapis.com, Already enabled (15/37)
API: docs.googleapis.com, Already enabled (16/37)
API: drive.googleapis.com, Already enabled (17/37)
API: driveactivity.googleapis.com, Already enabled (18/37)
API: drivelabels.googleapis.com, Already enabled (19/37)
API: forms.googleapis.com, Already enabled (20/37)
API: gmail.googleapis.com, Already enabled (21/37)
API: groupsmigration.googleapis.com, Already enabled (22/37)
API: groupssettings.googleapis.com, Already enabled (23/37)
API: iam.googleapis.com, Already enabled (24/37)
API: iamcredentials.googleapis.com, Already enabled (non-GAM which is fine) (25/37)
API: iap.googleapis.com, Already enabled (non-GAM which is fine) (26/37)
API: keep.googleapis.com, Already enabled (27/37)
API: licensing.googleapis.com, Already enabled (28/37)
API: people.googleapis.com, Already enabled (29/37)
API: pubsub.googleapis.com, Already enabled (30/37)
API: reseller.googleapis.com, Already enabled (31/37)
API: sheets.googleapis.com, Already enabled (32/37)
API: siteverification.googleapis.com, Already enabled (33/37)
API: storage-api.googleapis.com, Already enabled (34/37)
API: tasks.googleapis.com, Already enabled (35/37)
API: vault.googleapis.com, Already enabled (36/37)
API: youtube.googleapis.com, Already enabled (37/37)
Project: *******************, Enable 4 APIs
API: mybusinessaccountmanagement.googleapis.com, Enabled (1/4)
API: meet.googleapis.com, Enabled (2/4)
API: searchconsole.googleapis.com, Enabled (3/4)
API: tagmanager.googleapis.com, Enabled (4/4)
Project: *******************, Service Account: ********************************, Granting rights to rotate its own private key
Project: *******************, Service Account: ********************************, Granted rights to rotate its own private key

[*] 0) AlertCenter API
[*] 1) Analytics Admin API - readonly
[*] 2) Calendar API (supports readonly)
[*] 3) Chat API - Custom Emojis (supports readonly)
[*] 4) Chat API - Memberships (supports readonly)
[*] 5) Chat API - Memberships Admin (supports readonly)
[*] 6) Chat API - Messages (supports readonly)
[*] 7) Chat API - Spaces (supports readonly)
[*] 8) Chat API - Spaces Admin (supports readonly)
[*] 9) Chat API - Spaces Delete
[*] 10) Chat API - Spaces Delete Admin
[ ] 11) Chat API - User Sections (supports readonly)
[*] 12) Classroom API - Course Announcements (supports readonly)
[*] 13) Classroom API - Course Topics (supports readonly)
[*] 14) Classroom API - Course Work/Materials (supports readonly)
[*] 15) Classroom API - Course Work/Submissions (supports readonly)
[*] 16) Classroom API - Profile Emails
[*] 17) Classroom API - Profile Photos
[*] 18) Classroom API - Rosters (supports readonly)
[*] 19) Cloud Identity Devices API (supports readonly)
[*] 20) Docs API (supports readonly)
[*] 21) Drive API (supports readonly)
[*] 22) Drive API - write todrive data - has access to all Drive
[ ] 23) Drive Activity API v2 - must pair with Drive API
[*] 24) Drive Labels API - Admin (supports readonly)
[*] 25) Drive Labels API - User (supports readonly)
[ ] 26) Forms API - must pair with Drive API
[*] 27) Gmail API - Basic Settings (Filters, IMAP, Language, POP, Vacation) - read/write, Sharing Settings (Delegates, Forwarding, SendAs) - read
[*] 28) Gmail API - Full Access (Labels, Messages)
[*] 29) Gmail API - Full Access (Labels, Messages) except delete message
[ ] 30) Gmail API - Full Access - readonly
[ ] 31) Gmail API - Send Messages - including todrive
[*] 32) Gmail API - Sharing Settings (Delegates, Forwarding, SendAs) - write
[*] 33) Keep API (supports readonly)
[*] 34) Looker Studio API (supports readonly)
[ ] 35) Meet API - Manage/Display Meeting Spaces
[ ] 36) Meet API - Read Meeting Spaces metadata readonly
[*] 37) OAuth2 API
[*] 38) People API (supports readonly)
[*] 39) People API - Other Contacts - readonly
[*] 40) People Directory API - readonly
[ ] 41) Search Console API - readonly
[*] 42) Sheets API (supports readonly)
[*] 43) Sheets API - write todrive data - has access to all Sheets
[ ] 44) Site Verification API
[ ] 45) Tag Manager API - Accounts, Containers, Workspaces, Tags - readonly
[ ] 46) Tag Manager API - Users
[*] 47) Tasks API (supports readonly)
[ ] 48) Youtube API - readonly

Select an unselected scope [ ] by entering a number; yields [*]
For scopes that optionally support readonly, enter a number and an 'r' to grant readonly access; yields [R]
For scopes that optionally support actiononly, enter a number and an 'a' to grant actiononly access; yields [A]
Clear readonly access [R] or actiononly access [A] from a scope by entering a number; yields [*]
Unselect a selected scope [*] by entering a number; yields [ ]
Select all default scopes by entering an 's'; yields [*] for default scopes, [ ] for others
Unselect all scopes by entering a 'u'; yields [ ] for all scopes
Exit without changes/authorization by entering an 'e'
Continue to authorization by entering a 'c'

Please enter 0-48[a|r] or s|u|e|c: c
System time status
Your system time differs from admin.googleapis.com by less than 1 second PASS
Service Account Private Key Authentication
Authentication PASS
Service Account Private Key age; Google recommends rotating keys on a routine basis
Service Account Private Key age: 1043 days WARN
Domain-wide Delegation authentication:, User: **********************, Scopes: 35
https://mail.google.com/ PASS (1/35)
https://www.googleapis.com/auth/analytics.readonly PASS (2/35)
https://www.googleapis.com/auth/apps.alerts PASS (3/35)
https://www.googleapis.com/auth/calendar PASS (4/35)
https://www.googleapis.com/auth/chat.admin.delete PASS (5/35)
https://www.googleapis.com/auth/chat.admin.memberships PASS (6/35)
https://www.googleapis.com/auth/chat.admin.spaces PASS (7/35)
https://www.googleapis.com/auth/chat.customemojis PASS (8/35)
https://www.googleapis.com/auth/chat.delete PASS (9/35)
https://www.googleapis.com/auth/chat.memberships PASS (10/35)
https://www.googleapis.com/auth/chat.messages PASS (11/35)
https://www.googleapis.com/auth/chat.spaces PASS (12/35)
https://www.googleapis.com/auth/classroom.announcements PASS (13/35)
https://www.googleapis.com/auth/classroom.coursework.students PASS (14/35)
https://www.googleapis.com/auth/classroom.courseworkmaterials PASS (15/35)
https://www.googleapis.com/auth/classroom.profile.emails PASS (16/35)
https://www.googleapis.com/auth/classroom.profile.photos PASS (17/35)
https://www.googleapis.com/auth/classroom.rosters PASS (18/35)
https://www.googleapis.com/auth/classroom.topics PASS (19/35)
https://www.googleapis.com/auth/cloud-identity.devices PASS (20/35)************** This was failing previously
https://www.googleapis.com/auth/contacts PASS (21/35)
https://www.googleapis.com/auth/contacts.other.readonly PASS (22/35)
https://www.googleapis.com/auth/datastudio PASS (23/35)
https://www.googleapis.com/auth/directory.readonly PASS (24/35)
https://www.googleapis.com/auth/documents PASS (25/35)
https://www.googleapis.com/auth/drive PASS (26/35)
https://www.googleapis.com/auth/drive.admin.labels PASS (27/35)
https://www.googleapis.com/auth/drive.labels PASS (28/35)
https://www.googleapis.com/auth/gmail.modify PASS (29/35)
https://www.googleapis.com/auth/gmail.settings.basic PASS (30/35)
https://www.googleapis.com/auth/gmail.settings.sharing PASS (31/35)
https://www.googleapis.com/auth/keep PASS (32/35)
https://www.googleapis.com/auth/spreadsheets PASS (33/35)
https://www.googleapis.com/auth/tasks PASS (34/35)
https://www.googleapis.com/auth/userinfo.profile PASS (35/35)
Deprecated scopes that GAM should NEVER have DwD access to:, User:*****************************, Scopes: 3
https://www.googleapis.com/auth/cloud-identity PASS (1/3)
https://www.googleapis.com/auth/cloud-platform PASS (2/3)
https://www.googleapis.com/auth/iam PASS (3/3)
All scopes PASSED!
To update authorization (in case some scopes were unselected), please go to the following link in your browser:

*******

You will be directed to the Google Workspace admin console Security > API Controls > Domain-wide Delegation page
The "Add a new Client ID" box will open
Make sure that "Overwrite existing client ID" is checked
Click AUTHORIZE
When the box closes you're done
After authorizing it may take some time for this test to pass so wait a few moments and then try this command again.

Reply all

Reply to author

Forward