Changes to scopes needed for certain GAM commands?

27 views
Skip to first unread message

Adam Gross

unread,
Feb 10, 2026, 3:30:06 PM (11 days ago) Feb 10
to GAM for Google Workspace
Hi folks,

I'm looking for help/advice digging into an issue with the following GAM commands:
  • gam print group-members group <group>
  • gam print groups domain <domain> name
I'm calling these using a Google Workspace user account that does not have the Super Admin role, but they were working fine for a few years with two OAuth scopes: "Directory API - Groups (#34)" and "Groups Settings API (#44)".

Starting in mid-January, the commands started to fail with an error stating they required a new scope "Directory API - Domains (#33)": ERROR: Insufficient Permission, There are no scopes authorized for the API(s): Directory API - Domains or Directory API - Domains (supports readonly)

So I added that scope in the gam oauth create flow, and now I am discovering that the user account also needs the Domain Management Admin Role Privilege, as described at https://knowledge.workspace.google.com/admin/users/administrator-privilege-definitions#domains.

It seems odd that performing read-only operations with domain/directory groups requires permission to manage domains on the organization's Google Workspace account.  Does anyone know why this may be?  Were there any changes in GAM or Google's Admin SDK APIs earlier this year that may have impacted this? (I didn't see anything obvious at https://github.com/GAM-team/GAM/commits/main/ or at https://developers.google.com/workspace/admin/release-notes in recent months)

Thank you,
Adam

Ross Scroggs

unread,
Feb 11, 2026, 9:00:54 PM (10 days ago) Feb 11
to google-ap...@googlegroups.com
Get 7.34.00

Updated the following commands to not require the `Directory API - Domains` scope

unless the `internal` or `external` options are used to request the member category.

```

gam info|print groups

gam print|show group-members

gam info|print cigroups

gam print|show cigroup-members

gam <UserTypeEntity> print|show filesharecounts

```


Ross
----
Ross Scroggs



--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/1beff1d8-caf0-45bc-9d1b-58028528ec47n%40googlegroups.com.

Adam Gross

unread,
Feb 11, 2026, 10:50:05 PM (10 days ago) Feb 11
to GAM for Google Workspace
Ross, thank you for the help with this!  Especially for offering to chat on a video call and discuss.
For posterity, this was related to Google's changes surrounding internal & external classifications in Google Groups.

I pulled version 7.34.00, removed OAuth scope #33 from my authorization, and confirmed that the commands are working as they previously did.

Thanks,
Adam
Reply all
Reply to author
Forward
0 new messages