Enterprises

  • An Enterprises resource represents the binding between an EMM and a specific organization, which can be established through two different methods: one for Google managed domain customers and another for managed Google Play Accounts customers.

  • The API supports two primary flows for creating an enterprise binding: a manual process involving Admin console and API Console artifacts, and an automated process using generated URLs and a sign-up UI.

  • As an EMM, you have the flexibility to implement support for either or both of these enterprise creation approaches within your EMM console.

  • The Enterprises resource representation includes fields such asid,primaryDomain,name,administrator,googleAuthenticationSettings,enterpriseType, andmanagedGoogleDomainType, providing detailed information about the enterprise binding.

  • A variety of methods are available for interacting with Enterprises resources, including enrolling or unenrolling enterprises, generating signup URLs, managing service accounts, and setting the store layout.

For a list ofmethods for this resource, see the end of this page.

Resource representations

An Enterprises resource represents the binding between an EMM and a specific organization. That binding can be instantiated in one of two different ways using this API as follows:

  • For Google managed domain customers, the process involves usingEnterprises.enroll andEnterprises.setAccount (in conjunction with artifacts obtained from the Admin console and the Google API Console) and submitted to the EMM through a more-or-less manual process.
  • For managed Google Play Accounts customers, the process involves usingEnterprises.generateSignupUrl andEnterprises.completeSignup in conjunction with the managed Google Play sign-up UI (Google-provided mechanism) to create the binding without manual steps.
As an EMM, you can support either or both approaches in your EMM console. SeeCreate an Enterprise for details.

{  "kind": "androidenterprise#enterprise",  "id":string,  "primaryDomain":string,  "name":string,  "administrator": [    {      "email":string    }  ],  "googleAuthenticationSettings": {    "googleAuthenticationRequired":string,    "dedicatedDevicesAllowed":string,    "createdAt": {      "seconds":long,      "nanos":integer    },    "updatedAt": {      "seconds":long,      "nanos":integer    }  },  "enterpriseType":string,  "managedGoogleDomainType":string}
Property nameValueDescriptionNotes
administrator[]listAdmins of the enterprise. This is only supported for enterprises created via the EMM-initiated flow.

administrator[].emailstringThe admin's email address.
enterpriseTypestringThe type of the enterprise.

Acceptable values are:
  • "enterpriseTypeUnspecified"
  • "managedGoogleDomain"
  • "managedGooglePlayAccountsEnterprise"
googleAuthenticationSettingsnested objectSettings for Google-provided user authentication.
googleAuthenticationSettings.createdAtnested objectTimestamp of when the settings were first created or modified.
googleAuthenticationSettings.createdAt.nanosintegerNon-negative fractions of a second at nanosecond resolution. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be from 0 to 999,999,999 inclusive.
googleAuthenticationSettings.createdAt.secondslongRepresents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.
googleAuthenticationSettings.dedicatedDevicesAllowedstringWhether dedicated devices are allowed.

Acceptable values are:
  • "allowed"
  • "dedicatedDevicesAllowedUnspecified"
  • "disallowed"
googleAuthenticationSettings.googleAuthenticationRequiredstringWhether Google authentication is required.

Acceptable values are:
  • "googleAuthenticationRequiredUnspecified"
  • "notRequired"
  • "required"
googleAuthenticationSettings.updatedAtnested objectTimestamp of when the settings were last modified.
googleAuthenticationSettings.updatedAt.nanosintegerNon-negative fractions of a second at nanosecond resolution. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be from 0 to 999,999,999 inclusive.
googleAuthenticationSettings.updatedAt.secondslongRepresents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.
idstringThe unique ID for the enterprise.

idstringThe unique ID for the enterprise.

kindstring
managedGoogleDomainTypestringThe type of managed Google domain

Acceptable values are:
  • "managedGoogleDomainTypeUnspecified"
  • "typeDomain"
  • "typeTeam"
namestringThe name of the enterprise, for example, "Example, Inc".
primaryDomainstringThe enterprise's primary domain, such as "example.com".

Methods

acknowledgeNotificationSet
Acknowledges notifications that were received fromEnterprises.PullNotificationSet to prevent subsequent calls from returningthe same notifications.
completeSignup
Completes the signup flow, by specifying the Completion token andEnterprise token.This request must not be called multiple times for a given EnterpriseToken.
createWebToken
Returns a unique token to access an embeddable UI. To generate aweb UI, pass the generated token into the managed Google Play javascriptAPI. Each token may only be used to start one UI session. See theJavaScript API documentation for further information.
enroll
Enrolls an enterprise with the calling EMM.
generateEnterpriseUpgradeUrl
Generates an enterprise upgrade URL to upgrade an existing managed GooglePlay Accounts enterprise to a managed Google domain.Seethe guide to upgrading an enterprise for more details.
generateSignupUrl
Generates a sign-up URL.
get
Retrieves the name and domain of an enterprise.
getServiceAccount
Returns a service account and credentials. The service accountcan be bound to the enterprise by calling setAccount. The service accountis unique to this enterprise and EMM, and will be deleted if the enterpriseis unbound. The credentials contain private key data and are not storedserver-side.

This method can only be called after callingEnterprises.Enroll or Enterprises.CompleteSignup, and beforeEnterprises.SetAccount; at other times it will return an error.

Subsequent calls after the first will generate a new, unique set ofcredentials, and invalidate the previously generated credentials.

Once the service account is bound to the enterprise, it can be managedusing the serviceAccountKeys resource.

Note: After you create a key, you might need to wait for60 seconds or more before you perform another operation with the key. Ifyou try to perform an operation with the key immediately after you createthe key, and you receive an error, you canretrythe request with exponential backoff

.
getStoreLayout
Returns the store layout for the enterprise. If the store layouthas not been set, returns "basic" as the store layout type and nohomepage.
list
Looks up an enterprise by domain name.This is only supported for enterprises created via the Google-initiatedcreation flow. Lookup of the id is not needed for enterprises created viathe EMM-initiated flow since the EMM learns the enterprise ID in thecallback specified in the Enterprises.generateSignupUrl call.
pullNotificationSet
Pulls and returns a notification set for the enterprises associated withthe service account authenticated for the request. The notification set maybe empty if no notification are pending.
A notification set returned needs to be acknowledged within 20 secondsby calling Enterprises.AcknowledgeNotificationSet, unless thenotification set is empty.
Notifications that are not acknowledged within the 20 seconds willeventually be included again in the response to another PullNotificationSetrequest, and those that are never acknowledged will ultimately be deletedaccording to the Google Cloud Platform Pub/Sub system policy.
Multiple requests might be performed concurrently to retrievenotifications, in which case the pending notifications (if any) will besplit among each caller, if any are pending.
If no notifications are present, an empty notification list is returned.Subsequent requests may return more notifications once they becomeavailable.
sendTestPushNotification
Sends a test notification to validate the EMM integration withthe Google Cloud Pub/Sub service for this enterprise.
setAccount
Sets the account that will be used to authenticate to the API as theenterprise.
setStoreLayout
Sets the store layout for the enterprise. By default, storeLayoutTypeis set to "basic" and the basic store layout is enabled. The basiclayout only contains apps approved by the admin, and that havebeen added to the available product set for a user (using thesetAvailableProductSet call). Apps on the page are sorted in order oftheir product ID value. If you create a custom store layout (by settingstoreLayoutType = "custom" and setting a homepage), the basic storelayout is disabled.
unenroll
Unenrolls an enterprise from the calling EMM.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-10-02 UTC.