How do I set a departing user's forwarding address using the API?

Google Workspace Developers Q&A
1

When trying to automate some of our deprovisioning procedures I’m trying to set up a workflow that will automatically forward a users emails to their manager for 30 days when their account is suspended.

I’ve been using Okta workflows but when setting the manager’s email as the forwarding address I get an “Unrecognized forwarding address” error and “failed precondition” reason.

{
"message": "Unrecognized forwarding address",
"domain": "global",
"reason": "failedPrecondition"
}  

The addresses are on the same domain and are both active when the workflow step is being run, I was under the impression that an address on the same domain would be automatically accepted as a forwarding address. However the manager is receiving an email to verify the forwarding and I’m getting the above error.

The only steps I’m aware I need to do are creating the forwarding address and then enabling forwarding to that address. Is there another step I’ve overlooked or a setting in my workspace that would allow for forwarding addresses to be automatically accepted?

Full error example:

{
  "_error": true,
  "retry_count": 0,
  "flo": "9527d35e-e00a-43ae-b8bb-172d3ede8e75",
  "method": "QgfnexQyv",
  "execution": "48f81131-f6d1-4aa2-bdd5-e9c5d036c565",
  "module": "gmail.updateUserGmailSettings",
  "kind": "HTTP Request Error",
  "statusCode": 400,
  "headers": {
    "vary": "Origin,Accept-Encoding",
    "x-frame-options": "SAMEORIGIN",
    "alt-svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"",
    "accept-ranges": "none",
    "transfer-encoding": "chunked",
    "x-content-type-options": "nosniff",
    "cache-control": "private",
    "x-xss-protection": "0",
    "server": "ESF",
    "date": "Wed, 28 Sep 2022 18:31:50 GMT",
    "content-type": "application/json; charset=UTF-8"
  },
  "body": {
    "error": {
      "code": 400,
      "message": "Unrecognized forwarding address",
      "errors": [
        {
          "message": "Unrecognized forwarding address",
          "domain": "global",
          "reason": "failedPrecondition"
        }
      ],
      "status": "FAILED_PRECONDITION"
    }
  },
  "message": "400 Bad Request",
  "code": 400,
  "description": "HTTP Request Error",
  "steps": 93,
  "source": {
    "flo": "gmail:1.3.201:updateForwardingHelper",
    "method": "nAzDoYrNCO",
    "execution": "7baecfee-d72c-4ba4-b13a-0adc931a44a3",
    "module": "http.put"
  },
  "_fatal": null
}
2

You can do this with the free, open source, command-line, indispensable GAM tool. Check out:

for more details.

Specifically, see https://github.com/GAM-team/GAM/wiki/ExamplesEmailSettings#forwarding (and since GAM is open-source, you could also poke into the code to see how they do it, if you don’t want to use GAM directly).

Hope that helps,

Ian

3

Thanks Ian! I’m aware of GAM but I’m mostly concerned with the mechanism in the Google API that GAM takes advantage of and if there is an additional element needed to make it work. Perhaps setting up GAM would reveal some additional scopes that are required but as far as I can tell my existing project and its users should already have the right permissions.

4

@Bobshields GAM is open source so you can always look at the source code! -KAM