お客様のプロビジョニング

このチュートリアルでは、Reseller API を使用して顧客をプロビジョニングする方法について説明します。

お客様を適切にプロビジョニングするには、Google Workspace プラットフォームの複数の API にまたがる、相互に依存するいくつかの手順が必要です。

図 1. Google Workspace のお客様をプロビジョニングする手順の概要

上の図は、顧客をプロビジョニングするための各ステップで使用される API を示しています。

• Site Verification API を使用して、ドメイン確認トークンを配置します。
• Reseller API を使用して顧客を作成します。
• Directory API を使用して最初のユーザーを作成し、管理者にする。
• Reseller API を使用してサブスクリプションを作成します。
• Site Verification API を使用してドメインの所有権を確認します。

前提条件

• Google 販売パートナー ドメイン インスタンス。
• Google Workspace パートナー契約が完全に履行されている。

• Google アカウント
• Partner Sales Console で利用規約に同意します。
• 別の言語用のクライアント ライブラリをダウンロードする

環境の設定

このチュートリアルを完了するには、環境を設定します。

API を有効にする

Google API を使用する前に、Google Cloud プロジェクトで API を有効にする必要があります。1 つの Google Cloud プロジェクトで 1 つ以上の API を有効にできます。

• Google Cloud コンソールで、Reseller API、Site Verification API、Admin SDK API を有効にします。

  API を有効にする

サービス アカウントを作成する

サービス アカウントは、ユーザーではなくアプリケーションで使用される特別なアカウントです。サービス アカウントを使用すると、ロボット アカウントによるデータへのアクセスやアクションの実行、または Google Workspace や Cloud Identity のユーザーに代わってデータにアクセスできます。詳細については、サービス アカウントについてをご覧ください。

Google Cloud コンソール

1. Google Cloud コンソールで、メニュー > [IAM と管理] > [サービス アカウント] に移動します。

   [サービス アカウント] に移動

2. [サービス アカウントを作成] をクリックします。
3. サービス アカウントの詳細を入力し、[作成して続行] をクリックします。
   注: デフォルトでは、一意のサービス アカウント ID が作成されます。ID を変更する場合は、[サービス アカウント ID] フィールドで ID を変更します。
4. 省略可: サービス アカウントにロールを割り当てて、Google Cloud プロジェクトのリソースへのアクセス権を付与します。詳しくは、リソースへのアクセス権の付与、変更、取り消しをご覧ください。
5. [続行] をクリックします。
6. 省略可: このサービス アカウントを使用してアクションを管理、実行できるユーザーまたはグループを入力します。詳しくは、サービス アカウントの権限借用を管理するをご覧ください。
7. [完了] をクリックします。サービス アカウントのメールアドレスをメモします。

gcloud CLI

1. サービス アカウント

   gcloud iam service-accounts create SERVICE_ACCOUNT_NAME \
     --display-name="SERVICE_ACCOUNT_NAME"

   を作成します。
2. 省略可: サービス アカウントにロールを割り当てて、Google Cloud プロジェクトのリソースへのアクセス権を付与します。詳しくは、リソースへのアクセス権の付与、変更、取り消しをご覧ください。

サービス アカウントの認証情報を作成する

公開鍵/秘密鍵のペアの形式で認証情報を取得する必要があります。これらの認証情報は、アプリ内のサービス アカウント アクションを認可するためにコードで使用されます。

1. Google Cloud コンソールで、メニュー > [IAM と管理] > [サービス アカウント] に移動します。

   [サービス アカウント] に移動

2. サービス アカウントを選択します。
3. [鍵] > [鍵を追加] > [新しい鍵を作成] をクリックします。
4. [JSON] を選択し、[作成] をクリックします。

   新しい公開鍵と秘密鍵のペアが生成され、新しいファイルとしてマシンにダウンロードされます。ダウンロードした JSON ファイルを credentials.json という名前で作業ディレクトリに保存します。この鍵のコピーはこのファイルのみです。鍵を安全に保管する方法については、サービス アカウント キーの管理をご覧ください。

5. [Close] をクリックします。

サービス アカウントにドメイン全体の委任を設定する

Google Workspace 組織のユーザーの代わりに API を呼び出すには、特権管理者アカウントによって、Google Workspace 管理コンソールでサービス アカウントにドメイン全体の権限の委任を付与する必要があります。詳細については、ドメイン全体の権限をサービス アカウントに委任するをご覧ください。

1. Google Cloud コンソールで、メニュー > [IAM と管理] > [サービス アカウント] に移動します。

   [サービス アカウント] に移動

2. サービス アカウントを選択します。
3. [詳細設定を表示] をクリックします。
4. [ドメイン全体の委任] でサービス アカウントの [クライアント ID] を確認します。[ をコピー] をクリックして、クライアント ID の値をクリップボードにコピーします。

5. 関連する Google Workspace アカウントに対する特権管理者のアクセス権がある場合は、[Google Workspace 管理コンソールを表示] をクリックし、特権管理者ユーザー アカウントでログインして次の手順を続けます。

   関連する Google Workspace アカウントに対する特権管理者アクセス権がない場合は、そのアカウントの特権管理者に連絡し、サービス アカウントのクライアント ID と OAuth スコープのリストを送付して、管理コンソールで次の手順を実行できるようにします。

1. Google 管理コンソールで、メニュー アイコン > [セキュリティ] > [アクセスとデータ管理] > [API の制御] に移動します。

   [API の制御] に移動

2. [ドメイン全体の委任を管理] をクリックします。
3. [新しく追加] をクリックします。
4. [クライアント ID] に、先ほどコピーしたクライアント ID を貼り付けます。
5. [OAuth スコープ] フィールドに、アプリケーションに必要なスコープをカンマ区切りのリストで入力します。これは、OAuth 同意画面の設定時に定義したスコープのセットです。
6. [承認] をクリックします。

認証済み認証情報を使用してサービス オブジェクトを作成する

Google API を使用するには、まずアプリケーション内から認証と認証情報を設定する必要があります。Google クライアントライブラリが 代わりにこれを処理しますすべてのライブラリには、認証情報オブジェクトを作成するパターンがあり、すべての API へのアクセス権を付与し、各サービスに渡すことができます。通常、アプリケーションには 1 つの認証情報セットを設定し、すべての Google API 操作に 1 つのクラウド プロジェクトのみを使用します。

サービス アカウントの作成時に生成した JSON キーファイルを使用します。

Python

import sys
from apiclient.discovery import build
from apiclient.http import HttpError
from oauth2client.service_account import ServiceAccountCredentials

############## REPLACE WITH YOUR OWN VALUES ####################
JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json'
RESELLER_ADMIN_USER = '[e-mail]'
CUSTOMER_DOMAIN = 'example.com'
CUSTOMER_SITE = 'https://www.example.com'
################################################################

# Full List of scopes:
# https://developers.google.com/identity/protocols/googlescopes
OAUTH2_SCOPES = [
    'https://reseller.googleapis.com/auth/apps.order',
    'https://reseller.googleapis.com/auth/siteverification',
    'https://reseller.googleapis.com/auth/admin.directory.user',
]

credentials = ServiceAccountCredentials.from_json_keyfile_name(
    JSON_PRIVATE_KEY_FILE, OAUTH2_SCOPES).create_delegated(RESELLER_ADMIN_USER)

reseller_service = build(
    serviceName='reseller', version='v1', credentials=credentials)

directory_service = build(
    serviceName='admin', version='directory_v1', credentials=credentials)

verification_service = build(
    serviceName='siteVerification', version='v1', credentials=credentials)

Java

// OAuth2 and HTTP
import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpResponseException;
import com.google.api.client.json.jackson2.JacksonFactory;
// Directory API
import com.google.api.services.admin.directory.Directory;
import com.google.api.services.admin.directory.DirectoryScopes;
import com.google.api.services.admin.directory.model.User;
import com.google.api.services.admin.directory.model.UserMakeAdmin;
import com.google.api.services.admin.directory.model.UserName;
// Reseller API
import com.google.api.services.reseller.Reseller;
import com.google.api.services.reseller.ResellerScopes;
import com.google.api.services.reseller.model.Address;
import com.google.api.services.reseller.model.Customer;
import com.google.api.services.reseller.model.RenewalSettings;
import com.google.api.services.reseller.model.Seats;
import com.google.api.services.reseller.model.Subscription;
// Site Verification API
import com.google.api.services.siteVerification.SiteVerification;
import com.google.api.services.siteVerification.SiteVerificationScopes;
import com.google.api.services.siteVerification.model.SiteVerificationWebResourceGettokenRequest;
import com.google.api.services.siteVerification.model.SiteVerificationWebResourceGettokenResponse;
import com.google.api.services.siteVerification.model.SiteVerificationWebResourceResource;
// Java library imports
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.Arrays;
import java.util.List;

/**
 * This is a basic example of provisioning a Google Workspace customer.
 */
public class CodelabExample {
  // Full List of scopes:
  // https://developers.google.com/identity/protocols/googlescopes
  private static final List<String> OAUTH2_SCOPES = Arrays.asList(
    ResellerScopes.APPS_ORDER,
    SiteVerificationScopes.SITEVERIFICATION,
    DirectoryScopes.ADMIN_DIRECTORY_USER
  );

  /***************** REPLACE WITH YOUR OWN VALUES ********************************/
  public static final String JSON_PRIVATE_KEY_FILE = "path/to/json_key_file.json";
  public static final String RESELLER_ADMIN_USER = "[e-mail]";
  public static final String CUSTOMER_DOMAIN = "example.com";
  public static final String CUSTOMER_SITE = "https://www.example.com/";
  /*******************************************************************************/

  public static void main(String[] args)
      throws IOException, GeneralSecurityException, FileNotFoundException {
    // Instantiate services with authenticated credentials
    GoogleCredential jsonCredentials = GoogleCredential
      .fromStream(new FileInputStream(JSON_PRIVATE_KEY_FILE));
    GoogleCredential credentials = new GoogleCredential.Builder()
      .setTransport(GoogleNetHttpTransport.newTrustedTransport())
      .setJsonFactory(JacksonFactory.getDefaultInstance())
      .setServiceAccountScopes(OAUTH2_SCOPES)
      .setServiceAccountUser(RESELLER_ADMIN_USER)
      .setServiceAccountPrivateKey(jsonCredentials.getServiceAccountPrivateKey())
      .setServiceAccountId(jsonCredentials.getServiceAccountId())
      .build();

    Reseller resellerService = new Reseller.Builder(
        credentials.getTransport(),
        credentials.getJsonFactory(),
        credentials).setApplicationName("Google Workspace Creator").build();

    Directory directoryService = new Directory.Builder(
        credentials.getTransport(),
        credentials.getJsonFactory(),
        credentials).setApplicationName("Google Workspace Creator").build();

    SiteVerification verificationService = new SiteVerification.Builder(
        credentials.getTransport(),
        credentials.getJsonFactory(),
        credentials).setApplicationName("Google Workspace Creator").build();

C#

// OAuth2 and HTTP
using Google.Apis.Auth.OAuth2;
using Google.Apis.Services;
// Reseller API
using Google.Apis.Reseller.v1;
using Google.Apis.Reseller.v1.Data;
// Directory API
using Google.Apis.Admin.Directory.directory_v1;
using User = Google.Apis.Admin.Directory.directory_v1.Data.User;
using UserName = Google.Apis.Admin.Directory.directory_v1.Data.UserName;
using UserMakeAdmin = Google.Apis.Admin.Directory.directory_v1.Data.UserMakeAdmin;
//Site Verification API
using Google.Apis.SiteVerification.v1;
using Google.Apis.SiteVerification.v1.Data;
// System imports
using System;
using System.IO;

class CodelabExample
{
    // Full List of scopes:
    // https://developers.google.com/identity/protocols/googlescopes
    static string[] OAUTH2_SCOPES = {
        ResellerService.Scope.AppsOrder,
        DirectoryService.Scope.AdminDirectoryUser,
        SiteVerificationService.Scope.Siteverification
    };

    /***************** REPLACE WITH YOUR OWN VALUES ********************************/
    public static String JSON_PRIVATE_KEY_FILE = "path/to/json_key_file.json";
    public static String RESELLER_ADMIN_USER = "[e-mail]";
    public static String CUSTOMER_DOMAIN = "example.com";
    public static String CUSTOMER_SITE = "https://www.example.com/";
    /*******************************************************************************/

    static void Main(string[] args)
    {
        GoogleCredential credential;

        using (var stream = new FileStream(JSON_PRIVATE_KEY_FILE, FileMode.Open, FileAccess.Read))
        {
            credential = GoogleCredential
                .FromStream(stream)
                .CreateScoped(OAUTH2_SCOPES)
                .CreateWithUser(RESELLER_ADMIN_USER);
        }

        var resellerService = new ResellerService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
        });

        var directoryService = new DirectoryService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
        });

        var verificationService = new SiteVerificationService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
        });

PHP

// https://developers.google.com/api-client-library/php/
require_once 'vendor/autoload.php';

// Full List of scopes:
// https://developers.google.com/identity/protocols/googlescopes
$OAUTH2_SCOPES = [
  Google_Service_Reseller::APPS_ORDER,
  Google_Service_SiteVerification::SITEVERIFICATION,
  Google_Service_Directory::ADMIN_DIRECTORY_USER,
];

######### REPLACE WITH YOUR OWN VALUES ###############
$JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json';
$RESELLER_ADMIN_USER = '[e-mail]';
$CUSTOMER_DOMAIN = 'example.com';
$CUSTOMER_SITE = 'https://www.example.com/';
######################################################

$client = new Google_Client();
$client->setAuthConfig($JSON_PRIVATE_KEY_FILE);
$client->setSubject($RESELLER_ADMIN_USER);
$client->setScopes($OAUTH2_SCOPES);

$resellerService = new Google_Service_Reseller($client);
$directoryService = new Google_Service_Directory($client);
$verificationService = new Google_Service_SiteVerification($client);

Ruby

require 'googleauth'
require 'google/apis/reseller_v1'
require 'google/apis/site_verification_v1'
require 'google/apis/admin_directory_v1'

# Full List of scopes:
# https://developers.google.com/identity/protocols/googlescopes
OAUTH2_SCOPES = [
  'https://reseller.googleapis.com/auth/apps.order',
  'https://reseller.googleapis.com/auth/admin.directory.user',
  'https://reseller.googleapis.com/auth/siteverification',
]

####### REPLACE WITH YOUR OWN VALUES ###############
JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json'
RESELLER_ADMIN_USER = '[e-mail]'
CUSTOMER_DOMAIN = 'example.com'
CUSTOMER_SITE = 'https://www.example.com/'
####################################################

credentials = Google::Auth::ServiceAccountCredentials.make_creds(
  json_key_io: File.open(JSON_PRIVATE_KEY_FILE),
  scope: OAUTH2_SCOPES)
credentials.sub = RESELLER_ADMIN_USER

Google::Apis::RequestOptions.default.authorization = credentials

reseller_service = Google::Apis::ResellerV1::ResellerService.new
directory_service = Google::Apis::AdminDirectoryV1::DirectoryService.new
verification_service = Google::Apis::SiteVerificationV1::SiteVerificationService.new

Node.js

// NOTE: This script needs googleapis 28.0.0 or later as it uses promises
const {google} = require('googleapis');

// ############## REPLACE WITH YOUR OWN VALUES ####################
const JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json';
const RESELLER_ADMIN_USER = '[e-mail]';
const CUSTOMER_DOMAIN = 'example.com';
const CUSTOMER_SITE = 'https://www.example.com/';
// ################################################################

// Full List of scopes: https://developers.google.com/identity/protocols/googlescopes
const OAUTH2_SCOPES = [
  'https://reseller.googleapis.com/auth/apps.order',
  'https://reseller.googleapis.com/auth/siteverification',
  'https://reseller.googleapis.com/auth/admin.directory.user',
];

const authJWT = new google.auth.JWT({
  keyFile: JSON_PRIVATE_KEY_FILE,
  scopes: OAUTH2_SCOPES,
  subject: RESELLER_ADMIN_USER,
});

const resellerService = google.reseller({version: 'v1', auth: authJWT});
const directoryService = google.admin({version: 'directory_v1', auth: authJWT});
const verificationService = google.siteVerification({version: 'v1', auth: authJWT});

ドメインの所有権の証明プロセスを開始する

このステップは省略可能ですが、お客様のドメインの所有権を証明できる場合は実施することをおすすめします。このステップは、チュートリアルの最後にドメインを確認するときに終了します。

お客様のドメインを確認しないと、次の制限が適用されます。

• ユーザーは管理コンソールにアクセスして、手動でのドメイン所有権の確認プロセスに従うことしかできません。
• 作成から 21 日後に停止される可能性があります。

サイト確認トークンを取得する手順は次のとおりです。

1. サイト確認トークンを取得するには、Site Verification API を使用します。ドメインが以前に検証されているかどうかは検証できませんが、サイトを複数回検証すれば問題なく検証できます。INET_DOMAIN 型と SITE 型のどちらを検証するかによって、verificationMethod パラメータは異なります。次のいずれかを選択します。

   • INET_DOMAIN タイプの場合は、次のいずれかの verificationMethod パラメータを使用します。

     • DNS_TXT
     • DNS_CNAME

     次のトークン取得の例では、INET_DOMAIN タイプを使用しています。

     Python

     # Retrieve the site verification token and place it according to:
     # https://developers.google.com/site-verification/v1/getting_started#tokens
     response = verification_service.webResource().getToken(
         body={
             'site': {
                 'type': 'INET_DOMAIN',
                 'identifier': CUSTOMER_DOMAIN
             },
             'verificationMethod': 'DNS_TXT'
         }).execute()
     print(response)

     Java

     // Retrieve the site verification token and place it according to:
     // https://developers.google.com/site-verification/v1/getting_started#tokens
     SiteVerificationWebResourceGettokenRequest.Site getTokenSite =
         new SiteVerificationWebResourceGettokenRequest.Site()
             .setType("INET_DOMAIN")
             .setIdentifier(CUSTOMER_DOMAIN);
     
     SiteVerificationWebResourceGettokenRequest request =
         new SiteVerificationWebResourceGettokenRequest()
             .setVerificationMethod("DNS_TXT")
             .setSite(getTokenSite);
     
     SiteVerificationWebResourceGettokenResponse getTokenResponse =
         verificationService.webResource().getToken(request).execute();
     System.out.println("Site Verification Token: " + getTokenResponse.getToken());

     C#

     // Retrieve the site verification token and place it according to:
     // https://developers.google.com/site-verification/v1/getting_started#tokens
     SiteVerificationWebResourceGettokenRequest.SiteData getTokenSite =
         new SiteVerificationWebResourceGettokenRequest.SiteData()
         {
             Type = "INET_DOMAIN",
             Identifier = CUSTOMER_DOMAIN
         };
     
     SiteVerificationWebResourceGettokenRequest request =
         new SiteVerificationWebResourceGettokenRequest()
         {
             VerificationMethod = "DNS_TXT",
             Site = getTokenSite
         };
     
     SiteVerificationWebResourceGettokenResponse getTokenResponse =
         verificationService.WebResource.GetToken(request).Execute();
     Console.WriteLine("Site Verification Token: {0}", getTokenResponse.Token);

     PHP

     // Retrieve the site verification token and place it according to:
     // https://developers.google.com/site-verification/v1/getting_started#tokens
     $body =
     new Google_Service_SiteVerification_SiteVerificationWebResourceGettokenRequest([
       'verificationMethod' => 'DNS_TXT',
       'site' => [
         'type' => 'INET_DOMAIN',
         'identifier' => $CUSTOMER_DOMAIN
       ]
     ]);
     $response = $verificationService->webResource->getToken($body);
     print_r ($response);

     Ruby

     # Retrieve the site verification token and place it according to:
     # https://developers.google.com/site-verification/v1/getting_started#tokens
     request = Google::Apis::SiteVerificationV1::GetWebResourceTokenRequest.new(
       site: {
         type: 'INET_DOMAIN',
         identifier: CUSTOMER_DOMAIN
       },
       verification_method: 'DNS_TXT'
     )
     
     response = verification_service.get_web_resource_token(request)
     puts response.inspect

     Node.js

     /**
      * Retrieve the site verification token and place it according to:
      * https://developers.google.com/site-verification/v1/getting_started#tokens
      */
     const getTokenPromise = verificationService.webResource.getToken({
       requestBody: {
         site: {
           type: 'INET_DOMAIN',
           identifier: CUSTOMER_DOMAIN,
         },
         verificationMethod: 'DNS_TXT',
       }
     }).then(({data}) => {
       console.log(data);
       return data;
     });

   • SITE タイプの場合は、次のいずれかの verificationMethod パラメータを使用します。

     • FILE
     • META

     次のトークン取得の例では、SITE タイプと FILE 検証メソッドを使用しています。SITE 検証タイプを使用する場合は、識別子の前に http:// または https:// を付ける必要があります。

     Python

     # Retrieve the site verification token and place it according to:
     # https://developers.google.com/site-verification/v1/getting_started#tokens
     response = verification_service.webResource().getToken(
         body={
             'site': {
                 'type': 'SITE',
                 'identifier': CUSTOMER_SITE
             },
             'verificationMethod': 'FILE'
         }).execute()
     print(response)

     Java

     // Retrieve the site verification token and place it according to:
     // https://developers.google.com/site-verification/v1/getting_started#tokens
     SiteVerificationWebResourceGettokenRequest.Site getTokenSite =
         new SiteVerificationWebResourceGettokenRequest.Site()
             .setType("SITE")
             .setIdentifier(CUSTOMER_SITE);
     
     SiteVerificationWebResourceGettokenRequest request =
         new SiteVerificationWebResourceGettokenRequest()
             .setVerificationMethod("FILE")
             .setSite(getTokenSite);
     
     SiteVerificationWebResourceGettokenResponse getTokenResponse =
         verificationService.webResource().getToken(request).execute();
     System.out.println("Site Verification Token: " + getTokenResponse.getToken());

     C#

     // Retrieve the site verification token and place it according to:
     // https://developers.google.com/site-verification/v1/getting_started#tokens
     SiteVerificationWebResourceGettokenRequest.SiteData getTokenSite =
         new SiteVerificationWebResourceGettokenRequest.SiteData()
         {
             Type = "SITE",
             Identifier = CUSTOMER_SITE
         };
     
     SiteVerificationWebResourceGettokenRequest request =
         new SiteVerificationWebResourceGettokenRequest()
         {
             VerificationMethod = "FILE",
             Site = getTokenSite
         };
     
     SiteVerificationWebResourceGettokenResponse getTokenResponse =
         verificationService.WebResource.GetToken(request).Execute();
     Console.WriteLine("Site Verification Token: {0}", getTokenResponse.Token);

     PHP

     // Retrieve the site verification token and place it according to:
     // https://developers.google.com/site-verification/v1/getting_started#tokens
     $body =
     new Google_Service_SiteVerification_SiteVerificationWebResourceGettokenRequest([
       'verificationMethod' => 'FILE',
       'site' => [
         'type' => 'SITE',
         'identifier' => $CUSTOMER_DOMAIN
       ]
     ]);
     $response = $verificationService->webResource->getToken($body);
     print_r($response);

     Ruby

     # Retrieve the site verification token and place it according to:
     # https://developers.google.com/site-verification/v1/getting_started#tokens
     request = Google::Apis::SiteVerificationV1::GetWebResourceTokenRequest.new(
       site: {
         type: 'SITE',
         identifier: CUSTOMER_SITE
       },
       verification_method: 'FILE'
     )
     
     response = verification_service.get_web_resource_token(request)
     puts response.inspect

     Node.js

     /**
      * Retrieve the site verification token and place it according to:
      * https://developers.google.com/site-verification/v1/getting_started#tokens
      */
     const getTokenPromise = verificationService.webResource.getToken({
       requestBody: {
         site: {
           type: 'SITE',
           identifier: CUSTOMER_SITE,
         },
         verificationMethod: 'FILE',
       }
     }).then(({data}) => {
       console.log(data);
       return data;
     });

2. サイト確認トークンを DNS レコードまたはサイトに配置します。

Reseller API で顧客を作成する

1. Customers.Get メソッドを使用して、お客様が Google Workspace にすでに存在するかどうかを確認します。

   Python

   # Determine if customer domain already has Google Workspace
   try:
     response = reseller_service.customers().get(
         customerId=CUSTOMER_DOMAIN).execute()
     print('Customer already exists if call succeeds')
     sys.exit()
   except HttpError as error:
     if int(error.resp['status']) == 404:
       print('Domain available for Google Workspace creation')
     else:
       raise

   Java

   // Determine if customer domain already has Google Workspace
   try {
     resellerService.customers().get(CUSTOMER_DOMAIN).execute();
     System.out.println("Customer already exists if call succeeds");
     System.exit(0);
   } catch (HttpResponseException e) {
       if (e.getStatusCode() == 404) {
         System.out.println("Domain available for Google Workspace creation");
       } else { 
         throw e; 
       }
   }

   C#

   // Determine if customer domain already has Google Workspace
   try
   {
       resellerService.Customers.Get(CUSTOMER_DOMAIN).Execute();
       Console.WriteLine("Customer already exists if call succeeds");
       Environment.Exit(0);
   }
   catch (Google.GoogleApiException e) {
       if (e.Error.Code == 404)
       {
           Console.WriteLine("Domain available for Google Workspace creation");
       } else throw e;
   }

   PHP

   // Determine if customer domain already has Google Workspace
   try {
     $response = $resellerService->customers->get($CUSTOMER_DOMAIN);
     exit('Customer already exists if call succeeds');
   } catch(Google_Service_Exception $e) {
     if ($e->getErrors()[0]['reason'] == 'notFound'){
       print ("Domain available for Google Workspace creation\n");
     } else {
       throw $e;
     }
   }

   Ruby

   # Determine if customer domain already has Google Workspace
   begin
     reseller_service.get_customer(CUSTOMER_DOMAIN)
     abort('Customer already exists if call succeeds')
   rescue Google::Apis::ClientError => ex
     if ex.status_code == 404
       puts 'Domain available for Google Workspace creation'
     else
       raise ex
     end
   end

   Node.js

   // Determine if customer domain already has Google Workspace
   const getCustomerPromise = resellerService.customers.get({
     customerId: CUSTOMER_DOMAIN
   }).then(() => {
     throw new Error('Customer already exists');
   }, resErr => {
     if (resErr.code === 404) {
       console.log('Domain available for Google Workspace creation');
     } else {
       throw resErr;
     }
   });

2. レスポンスに応じて、次の操作を行います。

   • 顧客が存在しない場合、customers.get メソッドは HTTP 404 エラーコードを返します。次のステップに進み、Google Workspace で顧客レコードを作成します。

   • customers.get メソッドがエラーなしで返された場合は、alternateEmail プロパティのレスポンス本文をチェックして、お客様が貴社の顧客かどうかを確認します。alternateEmail プロパティがない場合は、お客様とお客様のサブスクリプションを移行する必要があります。

3. Google Workspace で顧客レコードを作成します。次のガイドラインに従って、そのお客様のサブスクリプションを作成する前に、お客様レコードを作成する必要があります。

   • alternateEmail は customerDomain と同じドメインにすることはできません。
   • postalAddress.countryCode は 2 文字の ISO 国コードである必要があります。

   次の例は、顧客レコードの作成を示しています。

   Python

   # Create customer resource
   response = reseller_service.customers().insert(
       body={
           'customerDomain': CUSTOMER_DOMAIN,
           'alternateEmail': '[e-mail]',
           'postalAddress': {
               'contactName': 'Marty McFly',
               'organizationName': 'Acme Corp',
               'postalCode': '10009',
               'countryCode': 'US',
           }
       }).execute()
   print(response)

   Java

   // Create customer resource
   Address address = new Address()
     .setContactName("Marty McFly")
     .setOrganizationName("Acme Corp")
     .setCountryCode("US")
     .setPostalCode("10009");
   
   Customer customer = new Customer()
     .setCustomerDomain(CUSTOMER_DOMAIN)
     .setAlternateEmail("[e-mail]")
     .setPostalAddress(address);
   
   Customer customerResponse = resellerService.customers()
     .insert(customer).execute();
   System.out.println("Created Customer:\n" + customerResponse);

   C#

   // Create customer resource
   Address address = new Address()
   {
       ContactName = "Marty McFly",
       OrganizationName = "Acme Corp",
       CountryCode = "US",
       PostalCode = "10009"
   };
   
   Customer customer = new Customer()
   {
       CustomerDomain = CUSTOMER_DOMAIN,
       AlternateEmail = "[e-mail]",
       PostalAddress = address
   };
   
   Customer customerResponse = resellerService.Customers.Insert(customer).Execute();
   Console.WriteLine("Created Customer:\n{0}", customerResponse);

   PHP

   // Create customer resource
   $customer = new Google_Service_Reseller_Customer([
     'customerDomain' => $CUSTOMER_DOMAIN,
     'alternateEmail' => '[e-mail]',
     'postalAddress' => [
       'contactName' => 'Marty McFly',
       'organizationName' => 'Acme Corp',
       'countryCode' => 'US',
       'postalCode' => '10009'
     ]
   ]);
   $response = $resellerService->customers->insert($customer);
   print_r ($response);

   Ruby

   # Create customer resource
   customer = Google::Apis::ResellerV1::Customer.new(
     customer_domain: CUSTOMER_DOMAIN,
     alternate_email: '[e-mail]',
     postal_address: {
       contact_name: 'Marty McFly',
       organization_name: 'Acme Corp',
       country_code: 'US',
       postal_code: '10009'})
   
   response = reseller_service.insert_customer(customer)
   puts response.inspect

   Node.js

   // Create customer resource
   const insertCustomerPromise = resellerService.customers.insert({
     requestBody: {
       customerDomain: CUSTOMER_DOMAIN,
       alternateEmail: '[e-mail]',
       postalAddress: {
         contactName: 'Marty McFly',
         organizationName: 'Acme Corp',
         postalCode: '10009',
         countryCode: 'US',
       }
     }
   }).then(({data}) => {
     console.log(data);
     return data;
   });

Admin SDK API で最初の管理者ユーザーを作成する

お客様をプロビジョニングしたら、最初のユーザーを作成し、すぐにユーザーをドメインの特権管理者にアップグレードする必要があります。これにより、お客様は新しいサービスにアクセスして、該当する利用規約に同意できます。

1. 最初のユーザーを作成し、パスワードを設定します。パスワードは十分に複雑で、8 文字以上にする必要があります。詳細については、user リソースをご覧ください。

   Python

   # Create first admin user
   response = directory_service.users().insert(
       body={
           'primaryEmail': 'marty.mcfly@' + CUSTOMER_DOMAIN,
           'name': {
               'givenName': 'Marty',
               'familyName': 'McFly',
           },
           'password': 'Timecircuit88'
       }).execute()
   print(response)

   Java

   // Create first admin user
   String userEmail = "marty.mcfly@" + CUSTOMER_DOMAIN;
   
   UserName name = new UserName();
   name.setGivenName("Marty");
   name.setFamilyName("McFly");
   
   User user = new User();
   user.setPrimaryEmail(userEmail);
   user.setPassword("TimeCircuit88");
   user.setName(name);
   
   User userResponse = directoryService.users().insert(user).execute();
   System.out.println("Created User:\n" + userResponse);

   C#

   // Create first admin user
   String userEmail = "marty.mcfly@" + CUSTOMER_DOMAIN;
   
   UserName name = new UserName()
   {
       GivenName = "Marty",
       FamilyName = "McFly"
   };
   
   User user = new User()
   {
       PrimaryEmail = userEmail,
       Password = "TimeCircuit88",
       Name = name
   };
   
   User userResponse = directoryService.Users.Insert(user).Execute();
   Console.WriteLine("Created User:\n{0}", userResponse);

   PHP

   // Create first admin user
   $user = new Google_Service_Directory_User([
     'primaryEmail' => 'marty.mcfly@' . $CUSTOMER_DOMAIN,
     'password' => 'Timecircuit88',
     'name' => [
       'givenName' => 'Marty',
       'familyName' => 'McFly',
       'fullName' => 'Marty McFly'
     ]
   ]);
   $response = $directoryService->users->insert($user);
   print_r ($response);

   Ruby

   # Create first admin user
   user = Google::Apis::AdminDirectoryV1::User.new(
     name: {
       given_name: 'Marty',
       family_name: 'McFly',
       full_name: 'Marty McFly'
     },
     password: 'Timecircuit88',
     primary_email: 'marty.mcfly@' + CUSTOMER_DOMAIN,
   )
   
   response = directory_service.insert_user(user)
   puts response.inspect

   Node.js

   // Create first admin user
   const insertUserPromise = directoryService.users.insert({
     requestBody: {
       primaryEmail: `marty.mcfly@${CUSTOMER_DOMAIN}`,
       name: {
         givenName: 'Marty',
         familyName: 'McFly',
       },
       password: 'Timecircuit88',
     }
   }).then(({data}) => {
     console.log(data);
     return data;
   });

   ユーザーを作成する呼び出しで HTTP 409 が返された場合、そのユーザー名が一般ユーザー向け Google アカウントとしてすでに存在している可能性があります。

2. ユーザーを特権管理者ロールにアップグレードします。

   Python

   # Promote user to admin status
   response = directory_service.users().makeAdmin(
       userKey='marty.mcfly@' + CUSTOMER_DOMAIN, body={
           'status': True
       }).execute()

   Java

   // Promote user to admin status
   UserMakeAdmin admin = new UserMakeAdmin();
   admin.setStatus(true);
   
   directoryService.users().makeAdmin(userEmail, admin).execute();
   System.out.println("User promoted to Admin");

   C#

   // Promote user to admin status
   UserMakeAdmin admin = new UserMakeAdmin()
   {
       Status = true
   };
   directoryService.Users.MakeAdmin(admin, userEmail).Execute();
   Console.WriteLine("User promoted to Admin");

   PHP

   // Promote user to admin status
   $makeAdmin = new Google_Service_Directory_UserMakeAdmin([
     'status' => true
   ]);
   $directoryService->users->makeAdmin(
     'marty.mcfly@' . $CUSTOMER_DOMAIN,
     $makeAdmin
   );

   Ruby

   # Promote user to admin status
   admin_status = Google::Apis::AdminDirectoryV1::UserMakeAdmin.new(
     status: true
   )
   
   response = directory_service.make_user_admin('marty.mcfly@' + CUSTOMER_DOMAIN, admin_status)

   Node.js

   // Promote user to admin status
   const makeAdminPromise = directoryService.users.makeAdmin({
     userKey: `marty.mcfly@${CUSTOMER_DOMAIN}`,
     requestBody: {
       status: true
     }
   });

顧客の Google Workspace サブスクリプションを作成する

お客様のサブスクリプションを作成するときに、このお客様の内部取引 ID または識別子を purchaseOrderId フィールドに入力する必要があります。特定の引数と値の詳細については、サブスクリプションの管理をご覧ください。

1. 定期購入を作成するには、Subscriptions.Insert 呼び出しを使用します。次の例では、ANNUAL_YEARLY_PAY サブスクリプションを使用しています。

   Python

   # Create subscription resource
   response = reseller_service.subscriptions().insert(
       customerId=CUSTOMER_DOMAIN,
       body={
           'customerId': CUSTOMER_DOMAIN,
           'skuId': '1010020027',
           'plan': {
               'planName': 'ANNUAL_MONTHLY_PAY',
           },
           'seats': {
               'numberOfSeats': 5,
           },
           'renewalSettings': {  # only relevant for annual plans
               'renewalType': 'RENEW_CURRENT_USERS_MONTHLY_PAY'
           }
       }).execute()
   print(response)

   Java

   // Create subscription resource
   Seats seats = new Seats()
     .setNumberOfSeats(5);
   
   Subscription.Plan plan = new Subscription.Plan()
     .setPlanName("ANNUAL_YEARLY_PAY");
   
   RenewalSettings renewalSettings = new RenewalSettings()
     .setRenewalType("RENEW_CURRENT_USERS_MONTHLY_PAY");
   
   Subscription subscription = new Subscription()
     .setCustomerId(CUSTOMER_DOMAIN)
     .setSeats(seats)
     .setPlan(plan)
     .setSkuId("1010020027")
     .setRenewalSettings(renewalSettings);
   
   Subscription subscriptionResponse = resellerService.subscriptions()
     .insert(CUSTOMER_DOMAIN, subscription).execute();
   System.out.println("Created Subscription:\n" + subscriptionResponse);

   C#

   // Create subscription resource
   Seats seats = new Seats()
   {
       NumberOfSeats = 5
   };
   
   Subscription.PlanData plan = new Subscription.PlanData()
   {
       PlanName = "ANNUAL_YEARLY_PAY"
   };
   
   RenewalSettings renewalSettings = new RenewalSettings()
   {
       RenewalType = "RENEW_CURRENT_USERS_MONTHLY_PAY"
   };
   
   Subscription subscription = new Subscription()
   {
       CustomerId = CUSTOMER_DOMAIN,
       Seats = seats,
       Plan = plan,
       SkuId = "1010020027",
       RenewalSettings = renewalSettings
   };
   
   Subscription subscriptionResponse = resellerService.Subscriptions
       .Insert(subscription, CUSTOMER_DOMAIN).Execute();
   Console.WriteLine("Created Subscription:\n" + subscriptionResponse);

   PHP

   // Create subscription resource
   $subscription = new Google_Service_Reseller_Subscription([
     'customerId' => $CUSTOMER_DOMAIN,
     'skuId' => '1010020027',
     'plan' => [
       'planName' => 'ANNUAL_MONTHLY_PAY'
     ],
     'seats' => [
       'numberOfSeats' => '5'
     ],
     'renewalSettings' => [
       'renewalType' => 'RENEW_CURRENT_USERS_MONTHLY_PAY'
     ]
   ]);
   $response = $resellerService->subscriptions->insert(
     $CUSTOMER_DOMAIN,
     $subscription
   );
   print_r ($response);

   Ruby

   # Create subscription resource
   subscription = Google::Apis::ResellerV1::Subscription.new(
     customer_id: CUSTOMER_DOMAIN,
     sku_id: '1010020027',
     plan: {
       plan_name: 'ANNUAL_MONTHLY_PAY'
     },
     seats: {
       number_of_seats: 5,
     },
     renewal_settings: {
       renewal_type: 'RENEW_CURRENT_USERS_MONTHLY_PAY'
     }
   )
   
   response = reseller_service.insert_subscription(CUSTOMER_DOMAIN, subscription)
   puts response.inspect

   Node.js

   // Create subscription resource
   const insertSubscriptionPromise = resellerService.subscriptions.insert({
     customerId: CUSTOMER_DOMAIN,
     requestBody: {
       customerId: CUSTOMER_DOMAIN,
       skuId: '1010020027',
       plan: {
         planName: 'ANNUAL_MONTHLY_PAY',
       },
       seats: {
         numberOfSeats: 5,
       },
       renewalSettings: { // only relevant for annual plans
         renewalType: 'RENEW_CURRENT_USERS_MONTHLY_PAY',
       }
     }
   }).then(({data}) => {
     console.log(data);
     return data;
   });

2. お客様の管理者がログインして利用規約に同意するまで、サブスクリプションは SUSPENDED 状態になります。お客様の管理者が Google プロパティ（Gmail や Google ドライブなど）にアクセスすると、初回ログイン時に利用規約にリダイレクトされます。

ドメインの所有権を証明してドメイン所有者を指定する

このステップは省略可能ですが、お客様のドメインの所有権を証明できる場合は実施することをおすすめします。Site Verification API の webResource.insert() 呼び出しはドメインを検証するとともに、リクエスト本文の owners[] パラメータで指定した所有者をドメインに割り当てます。

次の例は、INET_DOMAIN を確認する方法を示しています。

Python

# Verify domain and designate domain owners
response = verification_service.webResource().insert(
    verificationMethod='DNS_TXT',
    body={
        'site': {
            'type': 'INET_DOMAIN',
            'identifier': CUSTOMER_DOMAIN
        },
        'owners': ['marty.mcfly@' + CUSTOMER_DOMAIN]
    }).execute()
print(response)

Java

// Verify domain and designate domain owners
SiteVerificationWebResourceResource.Site verifySite =
      new SiteVerificationWebResourceResource.Site()
            .setIdentifier(CUSTOMER_DOMAIN)
            .setType("INET_DOMAIN");

List<String> owners = Arrays.asList(userEmail);

SiteVerificationWebResourceResource resource =
  new SiteVerificationWebResourceResource()
        .setSite(verifySite)
        .setOwners(owners);

SiteVerificationWebResourceResource verifyResponse = 
  verificationService.webResource().insert("DNS_TXT", resource).execute();
System.out.println("Site Verification Web Resource:\n" + verifyResponse);

C#

// Verify domain and designate domain owners
SiteVerificationWebResourceResource.SiteData verifySite =
      new SiteVerificationWebResourceResource.SiteData()
      {
          Identifier = CUSTOMER_DOMAIN,
          Type = "INET_DOMAIN"
      };

string[] owners = { userEmail };

SiteVerificationWebResourceResource resource =
  new SiteVerificationWebResourceResource()
  {
      Site = verifySite,
      Owners = owners
  };

SiteVerificationWebResourceResource verifyResponse =
    verificationService.WebResource.Insert(resource, "DNS_TXT").Execute();
Console.WriteLine("Site Verification Web Resource:\n" + verifyResponse);

PHP

// Verify domain and designate domain owners
$body =
new Google_Service_SiteVerification_SiteVerificationWebResourceResource([
  'site' => [
    'type' => 'INET_DOMAIN',
    'identifier' => $CUSTOMER_DOMAIN,
  ],
  'owners' => ['marty.mcfly@' . $CUSTOMER_DOMAIN]
]);

$response = $verificationService->webResource->insert('DNS_TXT', $body);
print_r ($response);

Ruby

# Verify domain and designate domain owners
webResource = Google::Apis::SiteVerificationV1::SiteVerificationWebResourceResource.new(
  site: {
    type: 'INET_DOMAIN',
    identifier: CUSTOMER_DOMAIN
  },
  owners: ['marty.mcfly@' + CUSTOMER_DOMAIN]
)

response = verification_service.insert_web_resource('DNS_TXT', webResource)
puts response.inspect

Node.js

// Verify domain and designate domain owners
const verifyDomainPromise = verificationService.webResource.insert({
  verificationMethod: 'DNS_TXT',
  requestBody: {
    site: {
      type: 'INET_DOMAIN',
      identifier: CUSTOMER_DOMAIN,
    },
    owners: [`marty.mcfly@${CUSTOMER_DOMAIN}`],
  }
}).then(({data}) => {
  console.log(data);
  return data;
});

成功すると、この呼び出しは HTTP 200 コードを返します。webResource.insert() がドメインの所有権を確認できない場合は、HTTP 400 レベルのエラーコードが返されます。ドメインの所有権の確認が正常に完了するまで、バックオフ遅延を置いて webResource.insert() 呼び出しを再試行します。

すべてをまとめる

次の例は、Google Workspace の顧客をプロビジョニングするための完全なコードを示しています。

Python

"""This is a basic example of provisioning a Google Workspace customer.
"""
import sys
from apiclient.discovery import build
from apiclient.http import HttpError
from oauth2client.service_account import ServiceAccountCredentials

############## REPLACE WITH YOUR OWN VALUES ####################
JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json'
RESELLER_ADMIN_USER = '[e-mail]'
CUSTOMER_DOMAIN = 'example.com'
CUSTOMER_SITE = 'https://www.example.com'
################################################################

# Full List of scopes:
# https://developers.google.com/identity/protocols/googlescopes
OAUTH2_SCOPES = [
    'https://reseller.googleapis.com/auth/apps.order',
    'https://reseller.googleapis.com/auth/siteverification',
    'https://reseller.googleapis.com/auth/admin.directory.user',
]

credentials = ServiceAccountCredentials.from_json_keyfile_name(
    JSON_PRIVATE_KEY_FILE, OAUTH2_SCOPES).create_delegated(RESELLER_ADMIN_USER)

reseller_service = build(
    serviceName='reseller', version='v1', credentials=credentials)

directory_service = build(
    serviceName='admin', version='directory_v1', credentials=credentials)

verification_service = build(
    serviceName='siteVerification', version='v1', credentials=credentials)

# Retrieve the site verification token and place it according to:
# https://developers.google.com/site-verification/v1/getting_started#tokens
response = verification_service.webResource().getToken(
    body={
        'site': {
            'type': 'INET_DOMAIN',
            'identifier': CUSTOMER_DOMAIN
        },
        'verificationMethod': 'DNS_TXT'
    }).execute()
print(response)

# Determine if customer domain already has Google Workspace
try:
  response = reseller_service.customers().get(
      customerId=CUSTOMER_DOMAIN).execute()
  print('Customer already exists if call succeeds')
  sys.exit()
except HttpError as error:
  if int(error.resp['status']) == 404:
    print('Domain available for Google Workspace creation')
  else:
    raise

# Create customer resource
response = reseller_service.customers().insert(
    body={
        'customerDomain': CUSTOMER_DOMAIN,
        'alternateEmail': '[e-mail]',
        'postalAddress': {
            'contactName': 'Marty McFly',
            'organizationName': 'Acme Corp',
            'postalCode': '10009',
            'countryCode': 'US',
        }
    }).execute()
print(response)

# Create first admin user
response = directory_service.users().insert(
    body={
        'primaryEmail': 'marty.mcfly@' + CUSTOMER_DOMAIN,
        'name': {
            'givenName': 'Marty',
            'familyName': 'McFly',
        },
        'password': 'Timecircuit88'
    }).execute()
print(response)

# Promote user to admin status
response = directory_service.users().makeAdmin(
    userKey='marty.mcfly@' + CUSTOMER_DOMAIN, body={
        'status': True
    }).execute()

# Create subscription resource
response = reseller_service.subscriptions().insert(
    customerId=CUSTOMER_DOMAIN,
    body={
        'customerId': CUSTOMER_DOMAIN,
        'skuId': '1010020027',
        'plan': {
            'planName': 'ANNUAL_MONTHLY_PAY',
        },
        'seats': {
            'numberOfSeats': 5,
        },
        'renewalSettings': {  # only relevant for annual plans
            'renewalType': 'RENEW_CURRENT_USERS_MONTHLY_PAY'
        }
    }).execute()
print(response)

# Verify domain and designate domain owners
response = verification_service.webResource().insert(
    verificationMethod='DNS_TXT',
    body={
        'site': {
            'type': 'INET_DOMAIN',
            'identifier': CUSTOMER_DOMAIN
        },
        'owners': ['marty.mcfly@' + CUSTOMER_DOMAIN]
    }).execute()
print(response)

Java

// OAuth2 and HTTP
import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpResponseException;
import com.google.api.client.json.jackson2.JacksonFactory;
// Directory API
import com.google.api.services.admin.directory.Directory;
import com.google.api.services.admin.directory.DirectoryScopes;
import com.google.api.services.admin.directory.model.User;
import com.google.api.services.admin.directory.model.UserMakeAdmin;
import com.google.api.services.admin.directory.model.UserName;
// Reseller API
import com.google.api.services.reseller.Reseller;
import com.google.api.services.reseller.ResellerScopes;
import com.google.api.services.reseller.model.Address;
import com.google.api.services.reseller.model.Customer;
import com.google.api.services.reseller.model.RenewalSettings;
import com.google.api.services.reseller.model.Seats;
import com.google.api.services.reseller.model.Subscription;
// Site Verification API
import com.google.api.services.siteVerification.SiteVerification;
import com.google.api.services.siteVerification.SiteVerificationScopes;
import com.google.api.services.siteVerification.model.SiteVerificationWebResourceGettokenRequest;
import com.google.api.services.siteVerification.model.SiteVerificationWebResourceGettokenResponse;
import com.google.api.services.siteVerification.model.SiteVerificationWebResourceResource;
// Java library imports
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.Arrays;
import java.util.List;

/**
 * This is a basic example of provisioning a Google Workspace customer.
 */
public class CodelabExample {
  // Full List of scopes:
  // https://developers.google.com/identity/protocols/googlescopes
  private static final List<String> OAUTH2_SCOPES = Arrays.asList(
    ResellerScopes.APPS_ORDER,
    SiteVerificationScopes.SITEVERIFICATION,
    DirectoryScopes.ADMIN_DIRECTORY_USER
  );

  /***************** REPLACE WITH YOUR OWN VALUES ********************************/
  public static final String JSON_PRIVATE_KEY_FILE = "path/to/json_key_file.json";
  public static final String RESELLER_ADMIN_USER = "[e-mail]";
  public static final String CUSTOMER_DOMAIN = "example.com";
  public static final String CUSTOMER_SITE = "https://www.example.com/";
  /*******************************************************************************/

  public static void main(String[] args)
      throws IOException, GeneralSecurityException, FileNotFoundException {
    // Instantiate services with authenticated credentials
    GoogleCredential jsonCredentials = GoogleCredential
      .fromStream(new FileInputStream(JSON_PRIVATE_KEY_FILE));
    GoogleCredential credentials = new GoogleCredential.Builder()
      .setTransport(GoogleNetHttpTransport.newTrustedTransport())
      .setJsonFactory(JacksonFactory.getDefaultInstance())
      .setServiceAccountScopes(OAUTH2_SCOPES)
      .setServiceAccountUser(RESELLER_ADMIN_USER)
      .setServiceAccountPrivateKey(jsonCredentials.getServiceAccountPrivateKey())
      .setServiceAccountId(jsonCredentials.getServiceAccountId())
      .build();

    Reseller resellerService = new Reseller.Builder(
        credentials.getTransport(),
        credentials.getJsonFactory(),
        credentials).setApplicationName("Google Workspace Creator").build();

    Directory directoryService = new Directory.Builder(
        credentials.getTransport(),
        credentials.getJsonFactory(),
        credentials).setApplicationName("Google Workspace Creator").build();

    SiteVerification verificationService = new SiteVerification.Builder(
        credentials.getTransport(),
        credentials.getJsonFactory(),
        credentials).setApplicationName("Google Workspace Creator").build();

    // Retrieve the site verification token and place it according to:
    // https://developers.google.com/site-verification/v1/getting_started#tokens
    SiteVerificationWebResourceGettokenRequest.Site getTokenSite =
        new SiteVerificationWebResourceGettokenRequest.Site()
            .setType("INET_DOMAIN")
            .setIdentifier(CUSTOMER_DOMAIN);

    SiteVerificationWebResourceGettokenRequest request =
        new SiteVerificationWebResourceGettokenRequest()
            .setVerificationMethod("DNS_TXT")
            .setSite(getTokenSite);

    SiteVerificationWebResourceGettokenResponse getTokenResponse =
        verificationService.webResource().getToken(request).execute();
    System.out.println("Site Verification Token: " + getTokenResponse.getToken());

    // Determine if customer domain already has Google Workspace
    try {
      resellerService.customers().get(CUSTOMER_DOMAIN).execute();
      System.out.println("Customer already exists if call succeeds");
      System.exit(0);
    } catch (HttpResponseException e) {
        if (e.getStatusCode() == 404) {
          System.out.println("Domain available for Google Workspace creation");
        } else { 
          throw e; 
        }
    }

    // Create customer resource
    Address address = new Address()
      .setContactName("Marty McFly")
      .setOrganizationName("Acme Corp")
      .setCountryCode("US")
      .setPostalCode("10009");

    Customer customer = new Customer()
      .setCustomerDomain(CUSTOMER_DOMAIN)
      .setAlternateEmail("[e-mail]")
      .setPostalAddress(address);

    Customer customerResponse = resellerService.customers()
      .insert(customer).execute();
    System.out.println("Created Customer:\n" + customerResponse);

    // Create first admin user
    String userEmail = "marty.mcfly@" + CUSTOMER_DOMAIN;

    UserName name = new UserName();
    name.setGivenName("Marty");
    name.setFamilyName("McFly");

    User user = new User();
    user.setPrimaryEmail(userEmail);
    user.setPassword("TimeCircuit88");
    user.setName(name);

    User userResponse = directoryService.users().insert(user).execute();
    System.out.println("Created User:\n" + userResponse);

    // Promote user to admin status
    UserMakeAdmin admin = new UserMakeAdmin();
    admin.setStatus(true);

    directoryService.users().makeAdmin(userEmail, admin).execute();
    System.out.println("User promoted to Admin");

    // Create subscription resource
    Seats seats = new Seats()
      .setNumberOfSeats(5);

    Subscription.Plan plan = new Subscription.Plan()
      .setPlanName("ANNUAL_YEARLY_PAY");

    RenewalSettings renewalSettings = new RenewalSettings()
      .setRenewalType("RENEW_CURRENT_USERS_MONTHLY_PAY");

    Subscription subscription = new Subscription()
      .setCustomerId(CUSTOMER_DOMAIN)
      .setSeats(seats)
      .setPlan(plan)
      .setSkuId("1010020027")
      .setRenewalSettings(renewalSettings);

    Subscription subscriptionResponse = resellerService.subscriptions()
      .insert(CUSTOMER_DOMAIN, subscription).execute();
    System.out.println("Created Subscription:\n" + subscriptionResponse);

    // Verify domain and designate domain owners
    SiteVerificationWebResourceResource.Site verifySite =
          new SiteVerificationWebResourceResource.Site()
                .setIdentifier(CUSTOMER_DOMAIN)
                .setType("INET_DOMAIN");

    List<String> owners = Arrays.asList(userEmail);

    SiteVerificationWebResourceResource resource =
      new SiteVerificationWebResourceResource()
            .setSite(verifySite)
            .setOwners(owners);

    SiteVerificationWebResourceResource verifyResponse = 
      verificationService.webResource().insert("DNS_TXT", resource).execute();
    System.out.println("Site Verification Web Resource:\n" + verifyResponse);
  }
}

C#

// OAuth2 and HTTP
using Google.Apis.Auth.OAuth2;
using Google.Apis.Services;
// Reseller API
using Google.Apis.Reseller.v1;
using Google.Apis.Reseller.v1.Data;
// Directory API
using Google.Apis.Admin.Directory.directory_v1;
using User = Google.Apis.Admin.Directory.directory_v1.Data.User;
using UserName = Google.Apis.Admin.Directory.directory_v1.Data.UserName;
using UserMakeAdmin = Google.Apis.Admin.Directory.directory_v1.Data.UserMakeAdmin;
//Site Verification API
using Google.Apis.SiteVerification.v1;
using Google.Apis.SiteVerification.v1.Data;
// System imports
using System;
using System.IO;

class CodelabExample
{
    // Full List of scopes:
    // https://developers.google.com/identity/protocols/googlescopes
    static string[] OAUTH2_SCOPES = {
        ResellerService.Scope.AppsOrder,
        DirectoryService.Scope.AdminDirectoryUser,
        SiteVerificationService.Scope.Siteverification
    };

    /***************** REPLACE WITH YOUR OWN VALUES ********************************/
    public static String JSON_PRIVATE_KEY_FILE = "path/to/json_key_file.json";
    public static String RESELLER_ADMIN_USER = "[e-mail]";
    public static String CUSTOMER_DOMAIN = "example.com";
    public static String CUSTOMER_SITE = "https://www.example.com/";
    /*******************************************************************************/

    static void Main(string[] args)
    {
        GoogleCredential credential;

        using (var stream = new FileStream(JSON_PRIVATE_KEY_FILE, FileMode.Open, FileAccess.Read))
        {
            credential = GoogleCredential
                .FromStream(stream)
                .CreateScoped(OAUTH2_SCOPES)
                .CreateWithUser(RESELLER_ADMIN_USER);
        }

        var resellerService = new ResellerService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
        });

        var directoryService = new DirectoryService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
        });

        var verificationService = new SiteVerificationService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
        });

        // Retrieve the site verification token and place it according to:
        // https://developers.google.com/site-verification/v1/getting_started#tokens
        SiteVerificationWebResourceGettokenRequest.SiteData getTokenSite =
            new SiteVerificationWebResourceGettokenRequest.SiteData()
            {
                Type = "INET_DOMAIN",
                Identifier = CUSTOMER_DOMAIN
            };

        SiteVerificationWebResourceGettokenRequest request =
            new SiteVerificationWebResourceGettokenRequest()
            {
                VerificationMethod = "DNS_TXT",
                Site = getTokenSite
            };

        SiteVerificationWebResourceGettokenResponse getTokenResponse =
            verificationService.WebResource.GetToken(request).Execute();
        Console.WriteLine("Site Verification Token: {0}", getTokenResponse.Token);

        // Determine if customer domain already has Google Workspace
        try
        {
            resellerService.Customers.Get(CUSTOMER_DOMAIN).Execute();
            Console.WriteLine("Customer already exists if call succeeds");
            Environment.Exit(0);
        }
        catch (Google.GoogleApiException e) {
            if (e.Error.Code == 404)
            {
                Console.WriteLine("Domain available for Google Workspace creation");
            } else throw e;
        }

        // Create customer resource
        Address address = new Address()
        {
            ContactName = "Marty McFly",
            OrganizationName = "Acme Corp",
            CountryCode = "US",
            PostalCode = "10009"
        };

        Customer customer = new Customer()
        {
            CustomerDomain = CUSTOMER_DOMAIN,
            AlternateEmail = "[e-mail]",
            PostalAddress = address
        };

        Customer customerResponse = resellerService.Customers.Insert(customer).Execute();
        Console.WriteLine("Created Customer:\n{0}", customerResponse);

        // Create first admin user
        String userEmail = "marty.mcfly@" + CUSTOMER_DOMAIN;

        UserName name = new UserName()
        {
            GivenName = "Marty",
            FamilyName = "McFly"
        };

        User user = new User()
        {
            PrimaryEmail = userEmail,
            Password = "TimeCircuit88",
            Name = name
        };

        User userResponse = directoryService.Users.Insert(user).Execute();
        Console.WriteLine("Created User:\n{0}", userResponse);

        // Promote user to admin status
        UserMakeAdmin admin = new UserMakeAdmin()
        {
            Status = true
        };
        directoryService.Users.MakeAdmin(admin, userEmail).Execute();
        Console.WriteLine("User promoted to Admin");

        // Create subscription resource
        Seats seats = new Seats()
        {
            NumberOfSeats = 5
        };

        Subscription.PlanData plan = new Subscription.PlanData()
        {
            PlanName = "ANNUAL_YEARLY_PAY"
        };

        RenewalSettings renewalSettings = new RenewalSettings()
        {
            RenewalType = "RENEW_CURRENT_USERS_MONTHLY_PAY"
        };

        Subscription subscription = new Subscription()
        {
            CustomerId = CUSTOMER_DOMAIN,
            Seats = seats,
            Plan = plan,
            SkuId = "1010020027",
            RenewalSettings = renewalSettings
        };

        Subscription subscriptionResponse = resellerService.Subscriptions
            .Insert(subscription, CUSTOMER_DOMAIN).Execute();
        Console.WriteLine("Created Subscription:\n" + subscriptionResponse);

        // Verify domain and designate domain owners
        SiteVerificationWebResourceResource.SiteData verifySite =
              new SiteVerificationWebResourceResource.SiteData()
              {
                  Identifier = CUSTOMER_DOMAIN,
                  Type = "INET_DOMAIN"
              };

        string[] owners = { userEmail };

        SiteVerificationWebResourceResource resource =
          new SiteVerificationWebResourceResource()
          {
              Site = verifySite,
              Owners = owners
          };

        SiteVerificationWebResourceResource verifyResponse =
            verificationService.WebResource.Insert(resource, "DNS_TXT").Execute();
        Console.WriteLine("Site Verification Web Resource:\n" + verifyResponse);
    }
}

PHP

// https://developers.google.com/api-client-library/php/
require_once 'vendor/autoload.php';

// Full List of scopes:
// https://developers.google.com/identity/protocols/googlescopes
$OAUTH2_SCOPES = [
  Google_Service_Reseller::APPS_ORDER,
  Google_Service_SiteVerification::SITEVERIFICATION,
  Google_Service_Directory::ADMIN_DIRECTORY_USER,
];

######### REPLACE WITH YOUR OWN VALUES ###############
$JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json';
$RESELLER_ADMIN_USER = '[e-mail]';
$CUSTOMER_DOMAIN = 'example.com';
$CUSTOMER_SITE = 'https://www.example.com/';
######################################################

$client = new Google_Client();
$client->setAuthConfig($JSON_PRIVATE_KEY_FILE);
$client->setSubject($RESELLER_ADMIN_USER);
$client->setScopes($OAUTH2_SCOPES);

$resellerService = new Google_Service_Reseller($client);
$directoryService = new Google_Service_Directory($client);
$verificationService = new Google_Service_SiteVerification($client);

// Retrieve the site verification token and place it according to:
// https://developers.google.com/site-verification/v1/getting_started#tokens
$body =
new Google_Service_SiteVerification_SiteVerificationWebResourceGettokenRequest([
  'verificationMethod' => 'DNS_TXT',
  'site' => [
    'type' => 'INET_DOMAIN',
    'identifier' => $CUSTOMER_DOMAIN
  ]
]);
$response = $verificationService->webResource->getToken($body);
print_r ($response);

// Determine if customer domain already has Google Workspace
try {
  $response = $resellerService->customers->get($CUSTOMER_DOMAIN);
  exit('Customer already exists if call succeeds');
} catch(Google_Service_Exception $e) {
  if ($e->getErrors()[0]['reason'] == 'notFound'){
    print ("Domain available for Google Workspace creation\n");
  } else {
    throw $e;
  }
}

// Create customer resource
$customer = new Google_Service_Reseller_Customer([
  'customerDomain' => $CUSTOMER_DOMAIN,
  'alternateEmail' => '[e-mail]',
  'postalAddress' => [
    'contactName' => 'Marty McFly',
    'organizationName' => 'Acme Corp',
    'countryCode' => 'US',
    'postalCode' => '10009'
  ]
]);
$response = $resellerService->customers->insert($customer);
print_r ($response);

// Create first admin user
$user = new Google_Service_Directory_User([
  'primaryEmail' => 'marty.mcfly@' . $CUSTOMER_DOMAIN,
  'password' => 'Timecircuit88',
  'name' => [
    'givenName' => 'Marty',
    'familyName' => 'McFly',
    'fullName' => 'Marty McFly'
  ]
]);
$response = $directoryService->users->insert($user);
print_r ($response);

// Promote user to admin status
$makeAdmin = new Google_Service_Directory_UserMakeAdmin([
  'status' => true
]);
$directoryService->users->makeAdmin(
  'marty.mcfly@' . $CUSTOMER_DOMAIN,
  $makeAdmin
);

// Create subscription resource
$subscription = new Google_Service_Reseller_Subscription([
  'customerId' => $CUSTOMER_DOMAIN,
  'skuId' => '1010020027',
  'plan' => [
    'planName' => 'ANNUAL_MONTHLY_PAY'
  ],
  'seats' => [
    'numberOfSeats' => '5'
  ],
  'renewalSettings' => [
    'renewalType' => 'RENEW_CURRENT_USERS_MONTHLY_PAY'
  ]
]);
$response = $resellerService->subscriptions->insert(
  $CUSTOMER_DOMAIN,
  $subscription
);
print_r ($response);

// Verify domain and designate domain owners
$body =
new Google_Service_SiteVerification_SiteVerificationWebResourceResource([
  'site' => [
    'type' => 'INET_DOMAIN',
    'identifier' => $CUSTOMER_DOMAIN,
  ],
  'owners' => ['marty.mcfly@' . $CUSTOMER_DOMAIN]
]);

$response = $verificationService->webResource->insert('DNS_TXT', $body);
print_r ($response);

Ruby

require 'googleauth'
require 'google/apis/reseller_v1'
require 'google/apis/site_verification_v1'
require 'google/apis/admin_directory_v1'

# Full List of scopes:
# https://developers.google.com/identity/protocols/googlescopes
OAUTH2_SCOPES = [
  'https://reseller.googleapis.com/auth/apps.order',
  'https://reseller.googleapis.com/auth/admin.directory.user',
  'https://reseller.googleapis.com/auth/siteverification',
]

####### REPLACE WITH YOUR OWN VALUES ###############
JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json'
RESELLER_ADMIN_USER = '[e-mail]'
CUSTOMER_DOMAIN = 'example.com'
CUSTOMER_SITE = 'https://www.example.com/'
####################################################

credentials = Google::Auth::ServiceAccountCredentials.make_creds(
  json_key_io: File.open(JSON_PRIVATE_KEY_FILE),
  scope: OAUTH2_SCOPES)
credentials.sub = RESELLER_ADMIN_USER

Google::Apis::RequestOptions.default.authorization = credentials

reseller_service = Google::Apis::ResellerV1::ResellerService.new
directory_service = Google::Apis::AdminDirectoryV1::DirectoryService.new
verification_service = Google::Apis::SiteVerificationV1::SiteVerificationService.new

# Retrieve the site verification token and place it according to:
# https://developers.google.com/site-verification/v1/getting_started#tokens
request = Google::Apis::SiteVerificationV1::GetWebResourceTokenRequest.new(
  site: {
    type: 'INET_DOMAIN',
    identifier: CUSTOMER_DOMAIN
  },
  verification_method: 'DNS_TXT'
)

response = verification_service.get_web_resource_token(request)
puts response.inspect

# Determine if customer domain already has Google Workspace
begin
  reseller_service.get_customer(CUSTOMER_DOMAIN)
  abort('Customer already exists if call succeeds')
rescue Google::Apis::ClientError => ex
  if ex.status_code == 404
    puts 'Domain available for Google Workspace creation'
  else
    raise ex
  end
end

# Create customer resource
customer = Google::Apis::ResellerV1::Customer.new(
  customer_domain: CUSTOMER_DOMAIN,
  alternate_email: '[e-mail]',
  postal_address: {
    contact_name: 'Marty McFly',
    organization_name: 'Acme Corp',
    country_code: 'US',
    postal_code: '10009'})

response = reseller_service.insert_customer(customer)
puts response.inspect

# Create first admin user
user = Google::Apis::AdminDirectoryV1::User.new(
  name: {
    given_name: 'Marty',
    family_name: 'McFly',
    full_name: 'Marty McFly'
  },
  password: 'Timecircuit88',
  primary_email: 'marty.mcfly@' + CUSTOMER_DOMAIN,
)

response = directory_service.insert_user(user)
puts response.inspect

# Promote user to admin status
admin_status = Google::Apis::AdminDirectoryV1::UserMakeAdmin.new(
  status: true
)

response = directory_service.make_user_admin('marty.mcfly@' + CUSTOMER_DOMAIN, admin_status)

# Create subscription resource
subscription = Google::Apis::ResellerV1::Subscription.new(
  customer_id: CUSTOMER_DOMAIN,
  sku_id: '1010020027',
  plan: {
    plan_name: 'ANNUAL_MONTHLY_PAY'
  },
  seats: {
    number_of_seats: 5,
  },
  renewal_settings: {
    renewal_type: 'RENEW_CURRENT_USERS_MONTHLY_PAY'
  }
)

response = reseller_service.insert_subscription(CUSTOMER_DOMAIN, subscription)
puts response.inspect

# Verify domain and designate domain owners
webResource = Google::Apis::SiteVerificationV1::SiteVerificationWebResourceResource.new(
  site: {
    type: 'INET_DOMAIN',
    identifier: CUSTOMER_DOMAIN
  },
  owners: ['marty.mcfly@' + CUSTOMER_DOMAIN]
)

response = verification_service.insert_web_resource('DNS_TXT', webResource)
puts response.inspect

Node.js

// NOTE: This script needs googleapis 28.0.0 or later as it uses promises
const {google} = require('googleapis');

// ############## REPLACE WITH YOUR OWN VALUES ####################
const JSON_PRIVATE_KEY_FILE = 'path/to/json_key_file.json';
const RESELLER_ADMIN_USER = '[e-mail]';
const CUSTOMER_DOMAIN = 'example.com';
const CUSTOMER_SITE = 'https://www.example.com/';
// ################################################################

// Full List of scopes: https://developers.google.com/identity/protocols/googlescopes
const OAUTH2_SCOPES = [
  'https://reseller.googleapis.com/auth/apps.order',
  'https://reseller.googleapis.com/auth/siteverification',
  'https://reseller.googleapis.com/auth/admin.directory.user',
];

const authJWT = new google.auth.JWT({
  keyFile: JSON_PRIVATE_KEY_FILE,
  scopes: OAUTH2_SCOPES,
  subject: RESELLER_ADMIN_USER,
});

const resellerService = google.reseller({version: 'v1', auth: authJWT});
const directoryService = google.admin({version: 'directory_v1', auth: authJWT});
const verificationService = google.siteVerification({version: 'v1', auth: authJWT});

// Run all the steps one after each other, and exit as soon as one of them fail
Promise.resolve()
  .then(() => {
    /**
     * Retrieve the site verification token and place it according to:
     * https://developers.google.com/site-verification/v1/getting_started#tokens
     */
    const getTokenPromise = verificationService.webResource.getToken({
      requestBody: {
        site: {
          type: 'INET_DOMAIN',
          identifier: CUSTOMER_DOMAIN,
        },
        verificationMethod: 'DNS_TXT',
      }
    }).then(({data}) => {
      console.log(data);
      return data;
    });


    return getTokenPromise;
  })
  .then(() => {
    // Determine if customer domain already has Google Workspace
    const getCustomerPromise = resellerService.customers.get({
      customerId: CUSTOMER_DOMAIN
    }).then(() => {
      throw new Error('Customer already exists');
    }, resErr => {
      if (resErr.code === 404) {
        console.log('Domain available for Google Workspace creation');
      } else {
        throw resErr;
      }
    });

    return getCustomerPromise;
  })
  .then(() => {
    // Create customer resource
    const insertCustomerPromise = resellerService.customers.insert({
      requestBody: {
        customerDomain: CUSTOMER_DOMAIN,
        alternateEmail: '[e-mail]',
        postalAddress: {
          contactName: 'Marty McFly',
          organizationName: 'Acme Corp',
          postalCode: '10009',
          countryCode: 'US',
        }
      }
    }).then(({data}) => {
      console.log(data);
      return data;
    });

    return insertCustomerPromise;
  })
  .then(() => {
    // Create first admin user
    const insertUserPromise = directoryService.users.insert({
      requestBody: {
        primaryEmail: `marty.mcfly@${CUSTOMER_DOMAIN}`,
        name: {
          givenName: 'Marty',
          familyName: 'McFly',
        },
        password: 'Timecircuit88',
      }
    }).then(({data}) => {
      console.log(data);
      return data;
    });

    return insertUserPromise;
  }).then(() => {
    // Promote user to admin status
    const makeAdminPromise = directoryService.users.makeAdmin({
      userKey: `marty.mcfly@${CUSTOMER_DOMAIN}`,
      requestBody: {
        status: true
      }
    });

    return makeAdminPromise;
  })
  .then(() => {
    // Create subscription resource
    const insertSubscriptionPromise = resellerService.subscriptions.insert({
      customerId: CUSTOMER_DOMAIN,
      requestBody: {
        customerId: CUSTOMER_DOMAIN,
        skuId: '1010020027',
        plan: {
          planName: 'ANNUAL_MONTHLY_PAY',
        },
        seats: {
          numberOfSeats: 5,
        },
        renewalSettings: { // only relevant for annual plans
          renewalType: 'RENEW_CURRENT_USERS_MONTHLY_PAY',
        }
      }
    }).then(({data}) => {
      console.log(data);
      return data;
    });

    return insertSubscriptionPromise;
  })
  .then(() => {
    // Verify domain and designate domain owners
    const verifyDomainPromise = verificationService.webResource.insert({
      verificationMethod: 'DNS_TXT',
      requestBody: {
        site: {
          type: 'INET_DOMAIN',
          identifier: CUSTOMER_DOMAIN,
        },
        owners: [`marty.mcfly@${CUSTOMER_DOMAIN}`],
      }
    }).then(({data}) => {
      console.log(data);
      return data;
    });

    return verifyDomainPromise;
  })
  .catch(err => {
    console.error('Error:', err.message);
    if (err.code) {
      console.log('Error code:', err.code);
    }
    if (err.errors) {
      console.log('Details:', err.errors);
    }
  });