Google Workspace 管理者権限なしで Google Groups のメンバーを API で一括管理する

service = build('admin', 'directory_v1', credentials=creds)
service.members().list(groupKey='group@example.com').execute()

pip install google-auth google-auth-oauthlib google-api-python-client

from google_auth_oauthlib.flow import InstalledAppFlow
from googleapiclient.discovery import build
import pickle, os

CLIENT_SECRET = 'client_secret.json'
TOKEN_FILE = 'token.pickle'
GROUP_EMAIL = 'your-group@example.com'
SCOPES = ['https://www.googleapis.com/auth/cloud-identity.groups']

def get_credentials():
    creds = None
    if os.path.exists(TOKEN_FILE):
        with open(TOKEN_FILE, 'rb') as f:
            creds = pickle.load(f)
    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:
            from google.auth.transport.requests import Request
            creds.refresh(Request())
        else:
            flow = InstalledAppFlow.from_client_secrets_file(CLIENT_SECRET, SCOPES)
            creds = flow.run_local_server(port=0)
        with open(TOKEN_FILE, 'wb') as f:
            pickle.dump(creds, f)
    return creds

creds = get_credentials()
service = build('cloudidentity', 'v1', credentials=creds)

# グループを検索
group = service.groups().lookup(groupKey_id=GROUP_EMAIL).execute()
group_name = group['name']

# メンバー一覧
result = service.groups().memberships().list(parent=group_name).execute()
for m in result.get('memberships', []):
    email = m['preferredMemberKey']['id']
    roles = [r['name'] for r in m.get('roles', [])]
    print(f"{email} - {', '.join(roles)}")

body = {
    'preferredMemberKey': {'id': 'new-user@example.com'},
    'roles': [{'name': 'MEMBER'}],
}
service.groups().memberships().create(parent=group_name, body=body).execute()

# membership_name は一覧取得時の m['name'] の値
service.groups().memberships().delete(name=membership_name).execute()

import time

NEW_MEMBERS = [
    'user1@example.com',
    'user2@example.com',
    'user3@example.com',
]

# 現在のメンバー一覧を取得
memberships = service.groups().memberships().list(parent=group_name).execute()

# OWNER 以外の MEMBER を削除
for m in memberships.get('memberships', []):
    roles = [r['name'] for r in m.get('roles', [])]
    if 'OWNER' in roles:
        continue  # オーナーは残す
    service.groups().memberships().delete(name=m['name']).execute()
    time.sleep(0.5)  # レートリミット対策

# 新メンバーを追加
for email in NEW_MEMBERS:
    body = {
        'preferredMemberKey': {'id': email},
        'roles': [{'name': 'MEMBER'}],
    }
    try:
        service.groups().memberships().create(parent=group_name, body=body).execute()
        time.sleep(0.5)
    except Exception as e:
        if '409' in str(e):
            print(f"既に存在: {email}")
        else:
            raise