Allowlisted Domains API now generally available

The Google Workspace Allowlisted Domains API is now generally available. Previously, administrators had to manage their allowlisted domains list manually through the Google Workspace Admin console. With this release, hosted under the Cloud Identity API suite as a top-level resource, organizations can securely automate and programmatically manage their list of allowlisted domains.

By programmatically managing trusted external sharing boundaries, Workspace administrators can easily automate domain lists. This allows organizations to restrict external collaboration to verified, trusted partners, thereby mitigating data exfiltration risks and strengthening overall security posture without manual administrative overhead.

This launch includes a robust set of core capabilities to support your domain management workflows:

Core CRUD operations: Programmatic Create, Delete, List, and Get capabilities to manage your list of allowlisted domains
Exact-match filtering: Easily check and verify the presence of specific domains using exact-match filtering within the List API

Note: Reseller-managed workflows are not currently supported.

Getting started

Admins: To configure these rules via the API, administrators must have either domain management or domain allowlist management privileges for Google Workspace. See our documentation to learn more.
End users: There is no end-user setting or action required for this feature.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) started on August 19, 2026

Availability

Available to all Google Workspace customers

Resources

Google Cloud Documentation: Allowlisted domains API overview

The Google Workspace Allowlisted Domains API is now generally available. This launch moves the management of trusted external sharing boundaries away from the manual Google Workspace Admin console. It is hosted under the Cloud Identity API suite as a top-level resource, allowing IT administrators to securely automate and programmatically manage their organization’s list of allowlisted domains. [1]

Key Features and Capabilities

Full CRUD Operations: Programmatically Create, Read, List, and Delete domain allowlists.
Filtering: Supports exact-match filtering for domain verification within the List API.
Risk Mitigation: Automatically restricts external collaboration to verified, trusted partners to prevent data exfiltration.
Gradual Rollout: The feature rollout started on August 19, 2026, with availability extending to all Workspace customers within 15 days.
Privileges Required: Admins must have domain management or domain allowlist management privileges. No end-user actions are required. [1, 2]

Current API Limitations

Before integrating this API into your administrative workflows, be aware of the following constraints outlined in the Cloud Identity Documentation: [3]

No Bulk Operations: You cannot perform bulk creation or deletion within a single API call. [3]
No Concurrency: Concurrent mutations for the same customer are blocked. Each mutation triggers a long-running operation (LRO) that must finish before starting a new one. [3]
Pagination Aborts: If any domain mutation occurs while a paginated list operation is active, the list operation fails with an ABORTED error and must be restarted from the beginning. [3]
Direct Customers Only: Initial support is strictly restricted to direct customers. Reseller-managed workflows are not currently supported. [3]