Stay organized with collections
Save and categorize content based on your preferences.
Get a membership graph of just a member or both a member and a group.
Note: This feature is only available to Google Workspace Enterprise Standard, Enterprise Plus, and Enterprise for Education; and Cloud Identity Premium accounts. If the account of the member is not one of these, a 403 (PERMISSION_DENIED) HTTP status code will be returned.
Given a member, the response will contain all membership paths from the member. Given both a group and a member, the response will contain all membership paths between the group and the member.
HTTP request
GET https://cloudidentity.googleapis.com/v1/{parent=groups/*}/memberships:getMembershipGraph
Required. Resource name of the group to search transitive memberships in.
Format: groups/{group}, where group is the unique ID assigned to the Group to which the Membership belongs to. group can be a wildcard collection id "-".
When a group is specified, the membership graph will be constrained to paths between the member (defined in the query) and the parent. If a wildcard collection is provided, all membership paths connected to the member will be returned.
Query parameters
Parameters
query
string
Required. A CEL expression that MUST include member specification AND label(s).
Certain groups are uniquely identified by both a 'member_key_id' and a 'member_key_namespace', which requires an additional query input: 'member_key_namespace'.
Example query: member_key_id == 'member_key_id_value' && <label_value> in
labels
Request body
The request body must be empty.
Response body
If successful, the response body contains an instance of Operation.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-06 UTC."],[[["\u003cp\u003eThis API endpoint allows you to retrieve a membership graph for a specific member, or between a member and a specified group.\u003c/p\u003e\n"],["\u003cp\u003eAccess to this feature requires a Google Workspace Enterprise Standard, Enterprise Plus, or Enterprise for Education; or Cloud Identity Premium account, otherwise a 403 error is returned.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eparent\u003c/code\u003e path parameter specifies the group to search, while the \u003ccode\u003equery\u003c/code\u003e parameter requires a CEL expression defining the member and label(s).\u003c/p\u003e\n"],["\u003cp\u003eThe API call is made via a \u003ccode\u003eGET\u003c/code\u003e request to a specific URL containing path and query parameters and uses gRPC Transcoding.\u003c/p\u003e\n"],["\u003cp\u003eThe request body must be empty, and the successful response returns an \u003ccode\u003eOperation\u003c/code\u003e instance.\u003c/p\u003e\n"]]],[],null,["# Method: groups.memberships.getMembershipGraph\n\nGet a membership graph of just a member or both a member and a group.\n\n**Note:** This feature is only available to Google Workspace Enterprise Standard, Enterprise Plus, and Enterprise for Education; and Cloud Identity Premium accounts. If the account of the member is not one of these, a 403 (PERMISSION_DENIED) HTTP status code will be returned.\n\nGiven a member, the response will contain all membership paths from the member. Given both a group and a member, the response will contain all membership paths between the group and the member.\n\n### HTTP request\n\n`GET https://cloudidentity.googleapis.com/v1/{parent=groups/*}/memberships:getMembershipGraph`\n\nThe URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.\n\n### Path parameters\n\n### Query parameters\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body contains an instance of [Operation](/identity/docs/reference/rest/Shared.Types/Operation).\n\n### Authorization scopes\n\nRequires one of the following OAuth scopes:\n\n- `https://www.googleapis.com/auth/cloud-identity.groups.readonly`\n- `https://www.googleapis.com/auth/cloud-identity.groups`\n- `https://www.googleapis.com/auth/cloud-identity`\n- `https://www.googleapis.com/auth/cloud-platform`\n\nFor more information, see the [Authorization guide](/workspace/guides/configure-oauth-consent)."]]
