Setting up the User Invitation API

This page explains how to set up the Cloud Identity User Invitation API.

Enabling the API and setting up credentials

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Roles required to select or create a project
• Select a project : Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project : To create a project, you need the Project Creator role ( roles/resourcemanager.projectCreator ), which contains the resourcemanager.projects.create permission. Learn how to grant roles .
Go to project selector
Enable the Cloud Identity API.
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role ( roles/serviceusage.serviceUsageAdmin ), which contains the serviceusage.services.enable permission. Learn how to grant roles .
Enable the API
Create a service account:
1. Ensure that you have the Create Service Accounts IAM role ( roles/iam.serviceAccountCreator ) and the Project IAM Admin role ( roles/resourcemanager.projectIamAdmin ). Learn how to grant roles .

2. In the Google Cloud console, go to the Create service account page.

   Go to Create service account
3. Select your project.

4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

   In the Service account description field, enter a description. For example, Service account for quickstart .

5. Click Create and continue .

6. Grant the Project > Owner role to the service account.

   To grant the role, find the Select a role list, then select Project > Owner .

7. Click Continue .

8. Click Done to finish creating the service account.

   Do not close your browser window. You will use it in the next step.
Create a service account key:
1. In the Google Cloud console, click the email address for the service account that you created.
2. Click Keys .
3. Click Add key , and then click Create new key .
4. Click Create . A JSON key file is downloaded to your computer.
5. Click Close .

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project : Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project : To create a project, you need the Project Creator role ( roles/resourcemanager.projectCreator ), which contains the resourcemanager.projects.create permission. Learn how to grant roles .

Go to project selector

Enable the Cloud Identity API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role ( roles/serviceusage.serviceUsageAdmin ), which contains the serviceusage.services.enable permission. Learn how to grant roles .

Enable the API

Create a service account:

1. Ensure that you have the Create Service Accounts IAM role ( roles/iam.serviceAccountCreator ) and the Project IAM Admin role ( roles/resourcemanager.projectIamAdmin ). Learn how to grant roles .

2. In the Google Cloud console, go to the Create service account page.

   Go to Create service account
3. Select your project.

4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

   In the Service account description field, enter a description. For example, Service account for quickstart .

5. Click Create and continue .

6. Grant the Project > Owner role to the service account.

   To grant the role, find the Select a role list, then select Project > Owner .

7. Click Continue .

8. Click Done to finish creating the service account.

   Do not close your browser window. You will use it in the next step.

Create a service account key:

1. In the Google Cloud console, click the email address for the service account that you created.
2. Click Keys .
3. Click Add key , and then click Create new key .
4. Click Create . A JSON key file is downloaded to your computer.
5. Click Close .

Installing the Python client library

To install the Python client library, run the following command:

 pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2 

For more on setting up your Python development environment, refer to the Python Development Environment Setup Guide .

Authenticating as a service account with domain-wide delegation

If you want to provide an account with domain-wide privileges so it can manage user invitations on behalf of admins, you should authenticate as a service account and then grant it the domain-wide privileges.

See Delegate domain-wide authority to your service account for instructions. You need to provide the following scope to authorize the service account:

• https://www.googleapis.com/auth/cloud-identity.userinvitations

Instantiating a client

The following example shows how to instantiate a client using service account credentials. To authenticate as an end-user instead, replace the credential object from the service account with the credential you obtained earlier in Using OAuth 2.0 for web server applications .

  from 
  
 google.oauth2 
  
 import 
 service_account 
 import 
  
 googleapiclient.discovery 
 SCOPES 
 = 
 [ 
 'https://www.googleapis.com/auth/cloud-identity.userinvitations' 
 ] 
 SERVICE_ACCOUNT_FILE 
 = 
 '/path/to/service-account-file.json' 
 def 
  
 create_service 
 (): 
 credentials 
 = 
 service_account 
 . 
 Credentials 
 . 
 from_service_account_file 
 ( 
 SERVICE_ACCOUNT_FILE 
 , 
 scopes 
 = 
 SCOPES 
 ) 
 delegated_credentials 
 = 
 credentials 
 . 
 with_subject 
 ( 
 'user@altostrat.com' 
 ) 
 service_name 
 = 
 'cloudidentity' 
 api_version 
 = 
 'v1' 
 service 
 = 
 googleapiclient 
 . 
 discovery 
 . 
 build 
 ( 
 service_name 
 , 
 api_version 
 , 
 credentials 
 = 
 delegated_credentials 
 ) 
 return 
 service 
 

You can now begin making calls to the User Invitation API.