Re: gam all users print delegates returns "Gmail API Service/App not enabled" — 401 Unauthorized on Service Account token request despite correct DWD scopes
Christian Gonzalez Villaseñor
My Goal is:
I'm trying to generate a full Gmail delegates audit report for my Google Workspace domain using:
gam all users print delegates > delegates_report.csvThe goal is to get a CSV with all users and their configured Gmail delegates (delegateAddress, delegationStatus) for compliance/audit purposes.
Hi GAM community,
I'm running GAM 7.46.01 on macOS (arm64) and hitting a wall with print delegates. I've done extensive debugging and can't figure out what's missing. Here's everything I know:
The command:
gam all users print delegatesThe error:
User: ad...@company.com, Gmail API Service/App not enabledThis happens for all users in the domain, including my own admin account.
What works:
gam print users ✅ — lists all users correctly
gam user ad...@company.com show drivefileacl root ✅ — DWD works for Drive
OAuth2 token is valid and correctly authenticated
What doesn't work:
Any Gmail command via DWD/Service Account impersonation
Debug output (debug_level 4):
The Service Account successfully connects to admin.googleapis.com and gmail.googleapis.com for discovery, but then fails at the token request:
POST oauth2.googleapis.com/token cred-type/sa reply: HTTP/1.1 401 UnauthorizedCurrent DWD scopes for the Service Account Client ID:
https://www.googleapis.com/auth/admin.reports.audit.readonly
(and several others for Admin SDK, Drive, Calendar, etc.)
GCP Project setup:
Gmail API: enabled in the project
OAuth app: configured as Internal
Service Account is trusted and API block-exempt in Admin Console → Security → API Controls → App Access Control
What I've already ruled out:
❌ Wrong Client ID — confirmed it matches between oauth2service.json and DWD entry
❌ OAuth token expired — gam oauth info shows valid token
❌ App Access Control blocking — Service Account is explicitly trusted
❌ Gmail disabled at domain level — Gmail is enabled for all users
❌ Missing Gmail scopes — mail.google.com/, gmail.settings.basic, and gmail.settings.sharing are all present in DWD
The 401 happens specifically when the Service Account tries to impersonate a user for Gmail — Drive impersonation works fine with the same Service Account and DWD setup.
Any ideas on what could cause Gmail impersonation to fail via DWD while Drive works perfectly?
Thanks in advance!
Christian Gonzalez Villaseñor
Ross Scroggs
--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/ae6308d5-0f31-45b5-b357-025de931c257n%40googlegroups.com.
Christian Gonzalez Villaseñor
Hi Ross,
I'm getting the error "Gmail API Service/App not enabled" when running GAM commands like (gam all users print delegates) against a user's Gmail account.
For context:
The service account is already authorized in Domain-wide Delegation with the following scopes:
The scopes were recently updated following your suggestion, but the error persists.
Is this error typically caused by something beyond the OAuth scopes? Could it be a Gmail API enablement issue at the Google Cloud project level, or something else you've seen before?
Any guidance would be appreciated. Thanks!
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/3C4C74A1-4F4E-4ACD-89CC-6EE2CD3F7D29%40gmail.com.
Christian Gonzalez Villaseñor
Hi Ross,
I'm getting the error "Gmail API Service/App not enabled" when running GAM commands like (gam all users print delegates) against a user's Gmail account.
For context:
The service account is already authorized in Domain-wide Delegation with the following scopes:
The scopes were recently updated following your suggestion, but the error persists.
Is this error typically caused by something beyond the OAuth scopes? Could it be a Gmail API enablement issue at the Google Cloud project level, or something else you've seen before?
Any guidance would be appreciated. Thanks!
Jay Lee
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/CAEUSPMoC%3DZx75goVA_JWbAcpNCpJkw78_bfEwqJ4sqSz6VzO4g%40mail.gmail.com.