# Automatically fetch user accounts ( Google IAM )

<p class="callout info">**STEP 1: Enable APIs**</p>

You’ll need access to one of the following APIs:

- **Cloud Identity API** (for non-Google Workspace orgs)
- **Admin SDK API** (for Google Workspace)

<p class="callout info">How to Enable:</p>

1. Go to Google Cloud Console
2. Navigate to: APIs &amp; Services &gt; Library
3. Search for:
    
    
    - Cloud Identity AP
    - Admin SDK API
4. Click **Enable**

---

<p class="callout info">**STEP 2: Set Up a Service Account**</p>

1. In the Cloud Console, go to : IAM &amp; Admin &gt; Service Accounts
2. Click **Create Service Account**
3. Name it and click **Create and Continue**
4. Assign roles:
    
    
    - For Cloud Identity: Cloud Identity User Read
    - For Admin SDK: Viewer or User Management Admin

---

<p class="callout info">**STEP 3: Create and Download Credentials**</p>

1. Go back to your service account.
2. Under the **Keys** tab, click **Add Key &gt; JSON**
3. Save the .json file securely — this will be used to authenticate API requests.

---

<p class="callout info">**STEP 4: Grant Domain-Wide Delegation (if using Admin SDK)**</p>

This allows your service account to impersonate an admin.

1. In the Service Account settings, enable **“Enable G Suite Domain-wide Delegation”**
2. Go to your [Google Admin console](https://admin.google.com/)
3. Add a new client: Security &gt; API Controls &gt; Domain-wide Delegation
    
    
    - **Client ID:** from your service account JSON

<p class="callout info">**STEP 5: Fetch User Accounts Pro-grammatically**</p>

Use Python and google-auth + google-api-python-client.

<p class="callout info">**STEP 6: Automate the Process**</p>

- Schedule the script to run via:
    
    
    - **Cloud Scheduler** (GCP-native)
    - **Cron job** (Linux VM)
    - **Cloud Functions / Cloud Run** (for serverless)

---

<p class="callout info">**STEP 7: Send or Sync Data**</p>

Once you fetch users:

- You can store them in:
    
    
    - Elasticsearch