> [!WARNING]
> **Developer Preview:** Available as part of the [Google Workspace Developer Preview Program](https://developers.google.com/workspace/preview.md.txt), which grants early access to certain features.

Before you call the Mail Admin Quarantine API, complete the steps on this page to enable the
API, find the identifiers that every request needs, and grant the required
administrator privileges in your Google Workspace account.

## Prerequisites

- A Google Workspace account with the admin quarantine feature. To learn more, see [Set up and manage email quarantines](https://support.google.com/a/answer/6104172).
- A Google Cloud project. To create a project, see [Create a project](https://developers.google.com/workspace/guides/create-project.md.txt).
- Membership in the [Google Workspace Developer Preview Program](https://developers.google.com/workspace/preview.md.txt). Your Cloud project must be enrolled in the program before it can call the Admin Quarantine API.
- Access to the Google Admin console as a [super administrator](https://knowledge.workspace.google.com/admin/users/prebuilt-administrator-roles#super-admin), to grant administrator privileges and authorize domain-wide delegation.

## Enable the API

Enable `mailadminquarantine.googleapis.com` in the Cloud project that hosts your
integration.

### Console

1. In the Google Cloud console, enable the Mail Admin Quarantine API.

   [Enable the API](https://console.cloud.google.com/apis/enableflow;apiid=mailadminquarantine.googleapis.com)

### gcloud

Run the following command, replacing
<var translate="no">PROJECT_ID</var> with your Cloud project ID:

```bash
gcloud services enable mailadminquarantine.googleapis.com \
    --project=PROJECT_ID
```

> [!NOTE]
> **Note:** While the Admin Quarantine API is in Developer Preview, it might not appear in the Google Cloud console **APIs \& Services \> Library** search results. Use the direct link or the gcloud command instead.

## Find your customer ID

Every request to the Admin Quarantine API identifies your Google Workspace
account with the `customers/CUSTOMER_ID` resource name.

To find your customer ID:

1. Sign in to the [Admin console](https://admin.google.com) as an administrator.
2. Go to **Account \> Account settings \> Profile**.
3. Copy the **Customer ID**.

If the customer ID starts with a `C`, remove the `C` and use the remaining
alphanumeric value in the resource name, for example `customers/01abc23de`.
Don't use your domain name as the customer ID.

For more information, see
[Find your customer ID](https://support.google.com/a/answer/10070793).

## Grant the required administrator privileges

The Admin Quarantine API enforces the same administrator privilege checks as the
admin quarantine in the Admin console. Every request runs on
behalf of a Google Workspace administrator, and that administrator
must hold one of the following Gmail privileges:

| Privilege | What it allows |
|---|---|
| **Access Admin Quarantine** | Access and manage messages in all quarantines, including the default quarantine. |
| **Access restricted quarantines** | Access and manage messages only in quarantines that are associated with groups the administrator belongs to. |

Super administrators have these privileges automatically. For other
administrators, assign a role that includes the privilege:

1. Sign in to the [Admin console](https://admin.google.com) as a super administrator.
2. Go to **Account \> Admin roles**.
3. Select an existing role or click **Create new role**.
4. In the **Privileges** tab, go to **Services \> Gmail** and select **Access Admin Quarantine** or **Access restricted quarantines**.
5. Assign the role to the administrator account that your integration impersonates when it calls the API.

For details about delegated administrator roles, see
[Delegate administrator privileges in Gmail](https://support.google.com/a/answer/2405986)
and
[Administrator privilege definitions](https://support.google.com/a/answer/1219251).

If the impersonated administrator doesn't have the required privilege, the API
returns a `403 PERMISSION_DENIED` error.

## Next steps

- [Authorize with domain-wide delegation](https://developers.google.com/workspace/gmail/admin-quarantine/guides/authorize.md.txt)