Failure to synchronize our Google Cloud Organization's identity with our new Google Workspace domain is causing 404 Not Found errors and blocking all access to Vertex AI publisher models

Google Cloud Build with AI Generative AI & Foundational Models
,
1

Hello Google Cloud Community,

We are facing a critical, account-level issue that is blocking all programmatic access to Vertex AI publisher models, and we have exhausted all client-side and Workspace-level troubleshooting. We are confident this is a Google Cloud Organization identity synchronization issue that requires a backend fix from Google.

The Core Problem

When making an API call from a correctly configured environment to any Vertex AI publisher model (e.g., gemini-2.5-computer-use-preview-10-2025), we receive a 404 NOT_FOUND error. However, we can successfully use Gemini models through the Vertex AI Studio web console. This strongly indicates the issue is not with user IAM permissions but with the programmatic authentication context.

The Exact Error:

<text>

404 NOT_FOUND: Publisher Model 'projects/(PII Removed by Staff)/locations/us-central1/publishers/google/models/gemini-2.5-computer-use-preview-10-2025' was not found or your project does not have access to it.

Background & Key Evidence

The root cause appears to be a recent Google Workspace primary domain change that has not been synchronized with our Google Cloud Organization’s identity.

  1. Domain Change: On November 8, 2025, we changed our primary Google Workspace domain from fxcb3.dev to xnet.ngo. This is confirmed by an alert in the Workspace Alert Center.

  2. Cloud Organization Mismatch: Our Google Cloud Organization (ID: (PII Removed by Staff)) is still identified by the old domain. The output of gcloud organizations describe (PII Removed by Staff) shows displayName: "(PII Removed by Staff)".

  3. Workspace Configuration: In the Google Workspace “Manage Domains” console, xnet.ngo is correctly set as the Primary Domain, but (PII Removed by Staff)v remains active as a “User alias domain.” We believe this active alias is preventing the Cloud Organization’s identity from being fully updated.

Comprehensive Troubleshooting Steps Performed

We have thoroughly investigated and ruled out all client-side and Workspace configuration issues:

  • Client Environment:

    • We have verified the correct Python virtual environment (.venv) is being used and all packages are fully up-to-date (including pip, google-genai, playwright, etc.).

    • We have installed all necessary system dependencies for our libraries (e.g., playwright install-deps).

    • We have correctly configured the environment variables (USE_VERTEXAI, VERTEXAI_PROJECT, VERTEXAI_LOCATION) in the .venv/bin/activate script.

    • We have confirmed basic programmatic authentication is working by successfully running gcloud ai models list --region=us-central1, which connects to the correct endpoint.

  • Google Workspace Admin Console:

    • We have reviewed the Alert Center, which confirms the domain change event.

    • We have confirmed all users in the Directory have been successfully migrated to the new @xnet.ngo domain.

    • We have reviewed Account Settings and the Domains section, which show a correct internal configuration from Workspace’s perspective. No errors or warnings are present.

Conclusion & Specific Request

All evidence points to a single root cause: our Google Cloud Organization’s identity is out of sync with our Google Workspace account. Our users are authenticating from xnet.ngo, but the Cloud Organization that owns the project is still identified as fxcb3.dev, which is not on the allowlist for the preview models we need to access.

We respectfully request that the Google Cloud team perform the necessary backend operation to synchronize our Google Cloud Organization’s identity to match our new primary domain, xnet.ngo.

Thank you for your time and assistance.