From 28b831c6a25c0e44122e307761373cea06c93c23 Mon Sep 17 00:00:00 2001
From: Ross Scroggs <ross.scroggs@gmail.com>
Date: Mon, 18 Jan 2021 14:03:58 -0800
Subject: [PATCH] Fix bug in calendar delete ACL, code assumed a role was
 included (#1308)

* Fix bug in calendar delete ACL, code assumed a role was included

Update documentation

* Add support for Chrome Browser Enrollment Tokens

create browsertoken always returns  `ERROR: 400: Invalid Input - invalid`
Maybe you can figure out what's going on
---
 src/GamCommands.txt      |  34 ++-
 src/cbcm-v1.1beta1.json  | 600 ++++++++++++++++++++++++++-------------
 src/gam/__init__.py      |  17 +-
 src/gam/gapi/calendar.py |   8 +-
 src/gam/gapi/cbcm.py     |  93 +++++-
 5 files changed, 538 insertions(+), 214 deletions(-)

diff --git a/src/GamCommands.txt b/src/GamCommands.txt
index ad4d7dcb..0294f1af 100644
--- a/src/GamCommands.txt
+++ b/src/GamCommands.txt
@@ -142,6 +142,7 @@ If an item contains spaces, it should be surrounded by ".
 <APIScopeURL> ::= <String>
 <ASPID> ::= <String>
 <AssetTag> ::= <String>
+<BrowserTokenPermanentID> ::= <String>
 <BuildingID> ::= <String>|id:<String>
 <CalendarACLRole> ::= editor|freebusy|freebusyreader|owner|reader|writer
 <CalendarACLRuleID> ::= user:<EmailAddress>|group:<EmailAddress>|domain:<DomainName>|default
@@ -204,6 +205,7 @@ If an item contains spaces, it should be surrounded by ".
 <PropertyKey> ::= <String>
 <PropertyValue> ::= <String>
 <QueryBrowser> ::= <String> See: https://support.google.com/chrome/a/answer/9681204#retrieve_all_chrome_devices_for_an_account
+<QueryBrowserToken> ::= <String> See: https://support.google.com/chrome/a/answer/9949706?ref_topic=9301744
 <QueryCalendar> ::= <String>
 <QueryContact> ::= <String> See: https://developers.google.com/google-apps/contacts/v3/reference#contacts-query-parameters-reference
 <QueryCrOS> ::= <String> See: https://support.google.com/chrome/a/answer/1698333?hl=en
@@ -1004,9 +1006,9 @@ gam delete alias|nickname [user|group|target] <UniqueID>|<EmailAddress>
 gam info alias|nickname <EmailAddress>
 gam print aliases|nicknames [todrive] [shownoneditable] [nogroups] [nousers] [(query <QueryUser>)|(queries <QueryUserList)]
 
-gam calendar <CalendarItem> add <CalendarACLRole> ([user] <EmailAddress>)|(group <EmailAddress>)|(domain [<DomainName>])|default [sendnotifications <Boolean>]
-gam calendar <CalendarItem> update <CalendarACLRole> ([user] <EmailAddress>)|(group <EmailAddress>)|(domain [<DomainName>])|default [sendnotifications <Boolean>]
-gam calendar <CalendarItem> del|delete <CalendarACLRole> <EmailAddress>|(domain [<DomainName>])|default
+gam calendar <CalendarItem> add <CalendarACLRole> ([user] <EmailAddress>)|(group <EmailAddress>)|(domain <DomainName>) [sendnotifications <Boolean>]
+gam calendar <CalendarItem> update <CalendarACLRole> ([user] <EmailAddress>)|(group <EmailAddress>)|(domain <DomainName>)|domain|default [sendnotifications <Boolean>]
+gam calendar <CalendarItem> del|delete ([user] <EmailAddress>)|(group <EmailAddress>)|(domain <DomainName>)|domainx|default
 gam calendar <CalendarItem> del|delete id <CalendarACLRuleID>
 gam calendar <CalendarItem> showacl
 gam calendar <CalendarItem> printacl [todrive]
@@ -1130,6 +1132,32 @@ gam print browsers [todrive]
 	[fields <BrowserFieldNameList>]
 	[sortheaders]
 
+gam create browsertoken
+        [ou|org|orgunit <OrgUnitPath>] [expire|expires <Time>]
+gam revoke browsertoken <BrowserTokenPermanentID>
+
+<BrowserTokenFieldName> ::=
+        createTime|
+        creatorId|
+        customerId|
+        expireTime|
+        orgUnitPath|
+        revokeTime|
+        revokerId|
+        state|
+        token|
+        tokenPermanentId
+<BrowserTokenFieldNameList> ::= "<BrowseTokenFieldName>(,<BrowserTokenFieldName>)*"
+
+gam show browsertokens
+	[query <QueryBrowserToken>]
+	[fields <BrowserTokenFieldNameList>]
+
+gam print browsertokens [todrive]
+	[query <QueryBrowserToken>]
+	[fields <BrowserTokenFieldNameList>]
+	[sortheaders]
+
 <CrOSAction> ::=
 	deprovision_same_model_replace|
 	deprovision_different_model_replace|
diff --git a/src/cbcm-v1.1beta1.json b/src/cbcm-v1.1beta1.json
index 8fa0f108..d2bd1d32 100644
--- a/src/cbcm-v1.1beta1.json
+++ b/src/cbcm-v1.1beta1.json
@@ -4,284 +4,284 @@
       "scopes": {
         "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers": {
           "description": "View and manage your Chrome browsers registered with Cloud Management"
-        }, 
+        },
         "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly": {
           "description": "View your Chrome browsers registered with Cloud Management"
         }
       }
     }
-  }, 
-  "basePath": "", 
-  "baseUrl": "https://www.googleapis.com/admin/directory/v1.1beta1/customer/", 
-  "batchPath": "batch", 
-  "canonicalName": "cbcm", 
-  "discoveryVersion": "v1", 
-  "documentationLink": "https://support.google.com/chrome/a/answer/9681204", 
-  "fullyEncodeReservedExpansion": true, 
+  },
+  "basePath": "",
+  "baseUrl": "https://www.googleapis.com/admin/directory/v1.1beta1/customer/",
+  "batchPath": "batch",
+  "canonicalName": "cbcm",
+  "discoveryVersion": "v1",
+  "documentationLink": "https://support.google.com/chrome/a/answer/9681204",
+  "fullyEncodeReservedExpansion": true,
   "icons": {
-    "x16": "http://www.google.com/images/icons/product/search-16.gif", 
+    "x16": "http://www.google.com/images/icons/product/search-16.gif",
     "x32": "http://www.google.com/images/icons/product/search-32.gif"
-  }, 
-  "id": "cbcm:v1.1beta1", 
-  "kind": "discovery#restDescription", 
-  "mtlsRootUrl": "https://admin.mtls.googleapis.com/", 
-  "name": "cbcm", 
-  "ownerDomain": "google.com", 
-  "ownerName": "Jay Lee", 
-  "packagePath": "cbcm", 
+  },
+  "id": "cbcm:v1.1beta1",
+  "kind": "discovery#restDescription",
+  "mtlsRootUrl": "https://admin.mtls.googleapis.com/",
+  "name": "cbcm",
+  "ownerDomain": "google.com",
+  "ownerName": "Jay Lee",
+  "packagePath": "cbcm",
   "parameters": {
     "$.xgafv": {
-      "description": "V1 error format.", 
+      "description": "V1 error format.",
       "enum": [
-        "1", 
+        "1",
         "2"
-      ], 
+      ],
       "enumDescriptions": [
-        "v1 error format", 
+        "v1 error format",
         "v2 error format"
-      ], 
-      "location": "query", 
+      ],
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "access_token": {
-      "description": "OAuth access token.", 
-      "location": "query", 
+      "description": "OAuth access token.",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "alt": {
-      "default": "json", 
-      "description": "Data format for response.", 
+      "default": "json",
+      "description": "Data format for response.",
       "enum": [
-        "json", 
-        "media", 
+        "json",
+        "media",
         "proto"
-      ], 
+      ],
       "enumDescriptions": [
-        "Responses with Content-Type of application/json", 
-        "Media download with context-dependent Content-Type", 
+        "Responses with Content-Type of application/json",
+        "Media download with context-dependent Content-Type",
         "Responses with Content-Type of application/x-protobuf"
-      ], 
-      "location": "query", 
+      ],
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "callback": {
-      "description": "JSONP", 
-      "location": "query", 
+      "description": "JSONP",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "fields": {
-      "description": "Selector specifying which fields to include in a partial response.", 
-      "location": "query", 
+      "description": "Selector specifying which fields to include in a partial response.",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "key": {
-      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.", 
-      "location": "query", 
+      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "oauth_token": {
-      "description": "OAuth 2.0 token for the current user.", 
-      "location": "query", 
+      "description": "OAuth 2.0 token for the current user.",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "prettyPrint": {
-      "default": "true", 
-      "description": "Returns response with indentations and line breaks.", 
-      "location": "query", 
+      "default": "true",
+      "description": "Returns response with indentations and line breaks.",
+      "location": "query",
       "type": "boolean"
-    }, 
+    },
     "quotaUser": {
-      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.", 
-      "location": "query", 
+      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "uploadType": {
-      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").", 
-      "location": "query", 
+      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
+      "location": "query",
       "type": "string"
-    }, 
+    },
     "upload_protocol": {
-      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").", 
-      "location": "query", 
+      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
+      "location": "query",
       "type": "string"
     }
-  }, 
-  "protocol": "rest", 
+  },
+  "protocol": "rest",
   "resources": {
     "chromebrowsers": {
       "methods": {
         "delete": {
-          "description": "Deletes a browser.", 
-          "flatPath": "{customer}/devices/chromebrowsers/{deviceId}", 
-          "httpMethod": "DELETE", 
-          "id": "cbcm.chromebrowsers.delete", 
+          "description": "Deletes a browser.",
+          "flatPath": "{customer}/devices/chromebrowsers/{deviceId}",
+          "httpMethod": "DELETE",
+          "id": "cbcm.chromebrowsers.delete",
           "parameterOrder": [
-            "customer", 
+            "customer",
             "deviceId"
-          ], 
+          ],
           "parameters": {
             "customer": {
-              "description": "Immutable ID of the G Suite account.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
               "type": "string"
-            }, 
+            },
             "deviceId": {
-              "description": "Immutable ID of the browser.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the browser.",
+              "location": "path",
+              "required": true,
               "type": "string"
             }
-          }, 
-          "path": "{customer}/devices/chromebrowsers/{deviceId}", 
+          },
+          "path": "{customer}/devices/chromebrowsers/{deviceId}",
           "scopes": [
             "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers"
           ]
-        }, 
+        },
         "get": {
-          "description": "Retrieves a browser.", 
-          "flatPath": "{customer}/devices/chromebrowsers/{deviceId}", 
-          "httpMethod": "GET", 
-          "id": "cbcm.chromebrowsers.get", 
+          "description": "Retrieves a browser.",
+          "flatPath": "{customer}/devices/chromebrowsers/{deviceId}",
+          "httpMethod": "GET",
+          "id": "cbcm.chromebrowsers.get",
           "parameterOrder": [
-            "customer", 
+            "customer",
             "deviceId"
-          ], 
+          ],
           "parameters": {
             "customer": {
-              "description": "Immutable ID of the G Suite account.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
               "type": "string"
-            }, 
+            },
             "deviceId": {
-              "description": "Immutable ID of the browser.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the browser.",
+              "location": "path",
+              "required": true,
               "type": "string"
-            }, 
+            },
             "projection": {
-              "description": "Restrict information returned to a set of selected fields. FULL or BASIC.", 
-              "location": "query", 
+              "description": "Restrict information returned to a set of selected fields. FULL or BASIC.",
+              "location": "query",
               "type": "string"
             }
-          }, 
-          "path": "{customer}/devices/chromebrowsers/{deviceId}", 
+          },
+          "path": "{customer}/devices/chromebrowsers/{deviceId}",
           "response": {
             "$ref": "ChromeBrowser"
-          }, 
+          },
           "scopes": [
-            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers", 
+            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers",
             "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly"
           ]
-        }, 
+        },
         "list": {
-          "description": "Retrieves a paginated list of all the browsers in a domain.", 
-          "flatPath": "{customer}/devices/chromebrowsers", 
-          "httpMethod": "GET", 
-          "id": "cbcm.chromebrowsers.list", 
+          "description": "Retrieves a paginated list of all the browsers in a domain.",
+          "flatPath": "{customer}/devices/chromebrowsers",
+          "httpMethod": "GET",
+          "id": "cbcm.chromebrowsers.list",
           "parameterOrder": [
             "customer"
-          ], 
+          ],
           "parameters": {
             "customer": {
-              "description": "Immutable ID of the G Suite account.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
               "type": "string"
-            }, 
+            },
             "maxResults": {
-              "description": "Maximum number of results to return.", 
-              "format": "int32", 
-              "location": "query", 
-              "maximum": "100", 
-              "minimum": "1", 
+              "description": "Maximum number of results to return.",
+              "format": "int32",
+              "location": "query",
+              "maximum": "100",
+              "minimum": "1",
               "type": "integer"
-            }, 
+            },
             "orderBy": {
-              "description": "property to use for sorting results.", 
-              "location": "query", 
+              "description": "property to use for sorting results.",
+              "location": "query",
               "type": "string"
-            }, 
+            },
             "orgUnitPath": {
-              "description": "The full path of the organizational unit or its unique ID.", 
-              "location": "query", 
+              "description": "The full path of the organizational unit or its unique ID.",
+              "location": "query",
               "type": "string"
-            }, 
+            },
             "pageToken": {
-              "description": "Token to specify the next page in the list.", 
-              "location": "query", 
+              "description": "Token to specify the next page in the list.",
+              "location": "query",
               "type": "string"
-            }, 
+            },
             "projection": {
-              "description": "Restrict information returned to a set of selected fields. FULL or BASIC.", 
-              "location": "query", 
+              "description": "Restrict information returned to a set of selected fields. FULL or BASIC.",
+              "location": "query",
               "type": "string"
-            }, 
+            },
             "query": {
-              "description": "Search string using the list page query language.", 
-              "location": "query", 
+              "description": "Search string using the list page query language.",
+              "location": "query",
               "type": "string"
-            }, 
+            },
             "sortOrder": {
-              "description": "Whether to return results in ascending or descending order. Must be used with the orderBy parameter.", 
-              "location": "query", 
+              "description": "Whether to return results in ascending or descending order. Must be used with the orderBy parameter.",
+              "location": "query",
               "type": "string"
             }
-          }, 
-          "path": "{customer}/devices/chromebrowsers", 
+          },
+          "path": "{customer}/devices/chromebrowsers",
           "response": {
             "$ref": "ChromeBrowsers"
-          }, 
+          },
           "scopes": [
-            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers", 
+            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers",
             "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly"
           ]
-        }, 
+        },
         "moveChromeBrowsersToOu": {
-          "description": "Move Chrome Browsers Device between Organization Units", 
-          "flatPath": "{customer}/devices/chromebrowsers/moveChromeBrowsersToOu", 
-          "httpMethod": "POST", 
-          "id": "cbcm.chromebrowsers.moveChromeBrowsersToOu", 
+          "description": "Move Chrome Browsers Device between Organization Units",
+          "flatPath": "{customer}/devices/chromebrowsers/moveChromeBrowsersToOu",
+          "httpMethod": "POST",
+          "id": "cbcm.chromebrowsers.moveChromeBrowsersToOu",
           "parameterOrder": [
             "customer"
-          ], 
+          ],
           "parameters": {
             "customer": {
-              "description": "Immutable ID of the G Suite account.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
               "type": "string"
             }
-          }, 
-          "path": "{customer}/devices/chromebrowsers/moveChromeBrowsersToOu", 
+          },
+          "path": "{customer}/devices/chromebrowsers/moveChromeBrowsersToOu",
           "request": {
             "$ref": "MoveChromeBrowsersRequest"
-          }, 
+          },
           "scopes": [
             "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers"
           ]
-        }, 
+        },
         "update": {
-          "description": "Updates a browser.", 
-          "flatPath": "{customer}/devices/chromebrowsers/{deviceId}", 
-          "httpMethod": "PUT", 
-          "id": "cbcm.chromebrowsers.update", 
+          "description": "Updates a browser.",
+          "flatPath": "{customer}/devices/chromebrowsers/{deviceId}",
+          "httpMethod": "PUT",
+          "id": "cbcm.chromebrowsers.update",
           "parameterOrder": [
-            "customer", 
+            "customer",
             "deviceId"
-          ], 
+          ],
           "parameters": {
             "customer": {
-              "description": "Immutable ID of the G Suite account.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
               "type": "string"
-            }, 
+            },
             "deviceId": {
-              "description": "Immutable ID of the browser.", 
-              "location": "path", 
-              "required": true, 
+              "description": "Immutable ID of the browser.",
+              "location": "path",
+              "required": true,
               "type": "string"
             },
             "projection": {
@@ -289,81 +289,275 @@
               "location": "query",
               "type": "string"
             }
-          }, 
-          "path": "{customer}/devices/chromebrowsers/{deviceId}", 
+          },
+          "path": "{customer}/devices/chromebrowsers/{deviceId}",
           "request": {
             "$ref": "ChromeBrowser"
-          }, 
+          },
           "response": {
             "$ref": "ChromeBrowser"
-          }, 
+          },
           "scopes": [
             "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers"
           ]
         }
       }
+    },
+    "enrollmentTokens": {
+      "methods": {
+        "list": {
+          "description": "Retrieves a paginated list of all the browser entollment tokens in a domain.",
+          "flatPath": "{customer}/chrome/enrollmentTokens",
+          "httpMethod": "GET",
+          "id": "cbcm.enrollmentTokens.list",
+          "parameterOrder": [
+            "customer"
+          ],
+          "parameters": {
+            "customer": {
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
+              "type": "string"
+            },
+            "pageSize": {
+              "description": "Maximum number of results to return.",
+              "format": "int32",
+              "location": "query",
+              "maximum": "100",
+              "minimum": "1",
+              "type": "integer"
+            },
+            "orgUnitPath": {
+              "description": "The full path of the organizational unit or its unique ID.",
+              "location": "query",
+              "type": "string"
+            },
+            "pageToken": {
+              "description": "Token to specify the next page in the list.",
+              "location": "query",
+              "type": "string"
+            },
+            "query": {
+              "description": "Search string using the list page query language.",
+              "location": "query",
+              "type": "string"
+            }
+          },
+          "path": "{customer}/chrome/enrollmentTokens",
+          "response": {
+            "$ref": "EnrollmentTokens"
+          },
+          "scopes": [
+            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers",
+            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly"
+          ]
+        },
+        "create": {
+          "description": "Creates a browser enrollment token in a domain.",
+          "flatPath": "{customer}/chrome/enrollmentTokens",
+          "httpMethod": "POST",
+          "id": "cbcm.enrollmentTokens.create",
+          "parameterOrder": [
+            "customer"
+          ],
+          "parameters": {
+            "customer": {
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
+              "type": "string"
+            }
+	  },
+          "path": "{customer}/chrome/enrollmentTokens",
+          "request": {
+            "$ref": "CreateEnrollmentTokenRequest"
+          },
+          "response": {
+            "$ref": "EnrollmentToken"
+          },
+          "scopes": [
+            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers"
+          ]
+	},
+        "revoke": {
+          "description": "Revokes a browser enrollment token in a domain.",
+          "flatPath": "{customer}/chrome/enrollmentTokens/{tokenPermanentId}:revoke",
+          "httpMethod": "POST",
+          "id": "cbcm.enrollmentTokens.revoke",
+          "parameterOrder": [
+            "customer",
+	    "tokenPermanentId"
+          ],
+          "parameters": {
+            "customer": {
+              "description": "Immutable ID of the G Suite account.",
+              "location": "path",
+              "required": true,
+              "type": "string"
+            },
+            "tokenPermanentId": {
+              "description": "Unique identifier for an enrollment token.",
+              "location": "path",
+              "required": true,
+              "type": "string"
+            }
+	  },
+          "path": "{customer}/chrome/enrollmentTokens/{tokenPermanentId}:revoke",
+          "scopes": [
+            "https://www.googleapis.com/auth/admin.directory.device.chromebrowsers"
+          ]
+	}
+      }
     }
-  }, 
-  "revision": "20201203", 
-  "rootUrl": "https://www.googleapis.com/admin/directory/v1.1beta1/customer/", 
+  },
+  "revision": "20201203",
+  "rootUrl": "https://www.googleapis.com/admin/directory/v1.1beta1/customer/",
   "schemas": {
     "ChromeBrowser": {
-      "id": "ChromeBrowser", 
+      "id": "ChromeBrowser",
       "properties": {
         "annotatedAssetId": {
-          "description": "Asset identifier as annotated by the administrator or specified during enrollment.", 
+          "description": "Asset identifier as annotated by the administrator or specified during enrollment.",
           "type": "string"
-        }, 
+        },
         "annotatedLocation": {
-          "description": "Address or location of the device as annotated by the administrator.", 
+          "description": "Address or location of the device as annotated by the administrator.",
           "type": "string"
-        }, 
+        },
         "annotatedNotes": {
-          "description": "Notes about this device as annotated by the administrator", 
+          "description": "Notes about this device as annotated by the administrator",
           "type": "string"
-        }, 
+        },
         "annotatedUser": {
-          "description": "User of the device as annotated by the administrator.", 
+          "description": "User of the device as annotated by the administrator.",
           "type": "string"
-        }, 
+        },
         "deviceId": {
           "annotations": {
             "required": [
               "cbcm.chromebrowsers.update"
             ]
-          }, 
-          "description": "The unique ID of the device.", 
+          },
+          "description": "The unique ID of the device.",
           "type": "string"
         }
-      }, 
+      },
       "type": "object"
-    }, 
+    },
     "ChromeBrowsers": {
-      "id": "ChromeBrowsers", 
+      "id": "ChromeBrowsers",
       "properties": {
         "browsers": {
-          "description": "List of Chrome browser objects.", 
+          "description": "List of Chrome browser objects.",
           "items": {
             "$ref": "ChromeBrowser"
-          }, 
+          },
           "type": "array"
-        }, 
+        },
         "etag": {
-          "description": "ETag of the resource.", 
+          "description": "ETag of the resource.",
           "type": "string"
-        }, 
+        },
         "kind": {
-          "default": "admin#directory#chromeosdevices", 
-          "description": "Kind of resource this is.", 
+          "default": "admin#directory#chromeosdevices",
+          "description": "Kind of resource this is.",
           "type": "string"
-        }, 
+        },
         "nextPageToken": {
-          "description": "Token used to access the next page of this result. To access the next page, use this token's value in the `pageToken` query string of this request.", 
+          "description": "Token used to access the next page of this result. To access the next page, use this token's value in the `pageToken` query string of this request.",
           "type": "string"
         }
-      }, 
+      },
       "type": "object"
-    }, 
+    },
+    "EnrollmentToken": {
+      "id": "EnrollmentToken",
+      "properties": {
+        "kind": {
+          "default": "admin#directory#chromeEnrollmentToken",
+          "description": "Kind of resource this is.",
+          "type": "string"
+        },
+        "tokenId": {
+          "description": "Enrollment Token ID.",
+          "type": "string"
+        },
+        "tokenPermanentId": {
+          "description": "Enrollment Token Permanent ID.",
+          "type": "string"
+        },
+        "customerId": {
+          "description": "Immutable ID of the G Suite account.",
+          "type": "string"
+        },
+	"orgUnitPath": {
+          "description": "The full path of the organizational unit or its unique ID.",
+          "type": "string"
+        },
+	"creatorId": {
+          "description": "Creator ID.",
+          "type": "string"
+        },
+	"createTime": {
+          "description": "Creation Time.",
+          "type": "string"
+        },
+	"revokerId": {
+          "description": "Revoker ID.",
+          "type": "string"
+        },
+	"revokeTime": {
+          "description": "Revoke Time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "EnrollmentTokens": {
+      "id": "EnrollmentTokens",
+      "properties": {
+        "chrome_enrollment_tokens": {
+          "description": "List of Chrome browser enrollment token objects.",
+          "items": {
+            "$ref": "EnrollmentToken"
+          },
+          "type": "array"
+        },
+        "kind": {
+          "default": "admin#directory#chromeEnrollmentTokens",
+          "description": "Kind of resource this is.",
+          "type": "string"
+        },
+        "nextPageToken": {
+          "description": "Token used to access the next page of this result. To access the next page, use this token's value in the `pageToken` query string of this request.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "CreateEnrollmentTokenRequest": {
+      "id": "CreateEnrollmentTokenRequest",
+      "properties": {
+	"org_unit_path": {
+          "description": "The full path of the organizational unit or its unique ID.",
+          "type": "string"
+        },
+	"expire_time": {
+          "description": "Expiration Time.",
+          "type": "string"
+        },
+	"token_type": {
+          "annotations": {
+            "required": [
+              "cbcm.enrollmentTokens.create"
+            ]
+          },
+          "description": "CHROME_BROWSER.",
+          "type": "string"
+        }
+      }
+    },
     "MoveChromeBrowsersRequest": {
       "properties": {
         "org_unit_path": {
@@ -371,23 +565,23 @@
             "required": [
               "cbcm.chromebrowsers.moveChromeBrowsersToOu"
             ]
-          }, 
-          "description": "Destination organization unit to move devices to. Full path of the organizational unit or its ID prefixed with id:", 
+          },
+          "description": "Destination organization unit to move devices to. Full path of the organizational unit or its ID prefixed with id:",
           "type": "string"
-        }, 
+        },
         "resource_ids": {
           "annotations": {
             "required": [
               "cbcm.chromebrowsers.moveChromeBrowsersToOu"
             ]
-          }, 
-          "description": "List of unique device IDs of Chrome Browser Devices to move. A maximum of 600 browsers may be moved per request.", 
+          },
+          "description": "List of unique device IDs of Chrome Browser Devices to move. A maximum of 600 browsers may be moved per request.",
           "type": "array"
         }
       }
     }
-  }, 
-  "servicePath": "", 
-  "title": "Admin SDK API", 
+  },
+  "servicePath": "",
+  "title": "Admin SDK API",
   "version": "cbcm_v1.1beta1"
 }
diff --git a/src/gam/__init__.py b/src/gam/__init__.py
index 2080d253..e7b1f0d3 100755
--- a/src/gam/__init__.py
+++ b/src/gam/__init__.py
@@ -1438,7 +1438,7 @@ def printShowDelegates(users, csvFormat):
             i += 1
         else:
             controlflow.invalid_argument_exit(sys.argv[i],
-                                              'gam <users> show delegates')
+                f"gam <users> {['show', 'print'][csvFormat]} delegates")
     count = len(users)
     i = 1
     for user in users:
@@ -7936,7 +7936,7 @@ def doPrintShowProjects(csvFormat):
             i += 1
         else:
             controlflow.invalid_argument_exit(
-                myarg, f"gam <users> {['show', 'print'][csvFormat]} projects")
+                myarg, f"gam {['show', 'print'][csvFormat]} projects")
     if not csvFormat:
         count = len(projects)
         print(f'User: {login_hint}, Show {count} Projects')
@@ -8096,7 +8096,7 @@ def printShowTeamDrives(users, csvFormat):
             i += 2
         else:
             controlflow.invalid_argument_exit(
-                myarg, 'gam <users> print|show teamdrives')
+                myarg, f"gam {['show', 'print'][csvFormat]} teamdrives")
     tds = []
     for user in users:
         sys.stderr.write(f'Getting Team Drives for {user}\n')
@@ -11126,6 +11126,8 @@ def ProcessGAMCommand(args):
                 createGCPFolder()
             elif argument in ['adminrole']:
                 gapi_directory_roles.create()
+            elif argument in ['browsertoken', 'browsertokens']:
+                gapi_cbcm.createtoken()
             else:
                 controlflow.invalid_argument_exit(argument, 'gam create')
             sys.exit(0)
@@ -11324,6 +11326,11 @@ def ProcessGAMCommand(args):
             else:
                 controlflow.invalid_argument_exit(argument, 'gam undelete')
             sys.exit(0)
+        elif command == 'revoke':
+            argument = sys.argv[2].lower()
+            if argument in ['browsertoken', 'browserokens']:
+                gapi_cbcm.revoketoken()
+            sys.exit(0)
         elif command in ['close', 'reopen']:
             # close and reopen will have to be split apart if either takes a new argument
             argument = sys.argv[2].lower()
@@ -11402,6 +11409,8 @@ def ProcessGAMCommand(args):
                 doPrintShowAlertFeedback()
             elif argument in ['browser', 'browsers']:
                 gapi_cbcm.print_()
+            elif argument in ['browsertoken', 'browsertokens']:
+                gapi_cbcm.printshowtokens(True)
             elif argument in ['vaultcount']:
                 gapi_vault.print_count()
             else:
@@ -11419,6 +11428,8 @@ def ProcessGAMCommand(args):
                 doPrintShowProjects(False)
             elif argument in ['sakey', 'sakeys']:
                 doShowServiceAccountKeys()
+            elif argument in ['browsertoken', 'browsertokens']:
+                gapi_cbcm.printshowtokens(False)
             else:
                 controlflow.invalid_argument_exit(argument, 'gam show')
             sys.exit(0)
diff --git a/src/gam/gapi/calendar.py b/src/gam/gapi/calendar.py
index db8cfd34..21845ce9 100644
--- a/src/gam/gapi/calendar.py
+++ b/src/gam/gapi/calendar.py
@@ -154,7 +154,11 @@ def delACL():
         gapi.call(cal.acl(), 'delete', calendarId=calendarId, ruleId=ruleId)
     else:
         body = {'role': 'none'}
-        _getCalendarACLScope(5, body)
+        i = 4
+        myarg = sys.argv[i].lower().replace('_', '')
+        if myarg in CALENDAR_ACL_ROLES_MAP:
+            i += 1
+        _getCalendarACLScope(i, body)
         print(f'Calendar: {calendarId}, Delete ACL: {formatACLScope(body)}')
         gapi.call(cal.acl(),
                   'insert',
@@ -824,7 +828,7 @@ def _showCalendar(userCalendar, j, jcount):
     print(f'    Color ID: {userCalendar["colorId"]}, ' \
           f'Background Color: {userCalendar["backgroundColor"]}, ' \
           f'Foreground Color: {userCalendar["foregroundColor"]}')
-    print(f'    Default Reminders:')
+    print('    Default Reminders:')
     for reminder in userCalendar.get('defaultReminders', []):
         print(f'      Method: {reminder["method"]}, ' \
               f'Minutes: {reminder["minutes"]}')
diff --git a/src/gam/gapi/cbcm.py b/src/gam/gapi/cbcm.py
index 73fa4dbb..95ead15d 100644
--- a/src/gam/gapi/cbcm.py
+++ b/src/gam/gapi/cbcm.py
@@ -143,13 +143,14 @@ def print_():
             sort_headers = True
             i += 1
         elif myarg == 'fields':
-            fields = sys.argv[i + 1]
+            fields = sys.argv[i + 1].replace(',', ' ').split()
             i += 2
         else:
             controlflow.invalid_argument_exit(sys.argv[i],
                                               'gam print browsers')
     if fields:
-        fields = f'browsers({fields}),nextPageToken'
+        fields.append('deviceId')
+        fields = f'browsers({",".join(set(fields))}),nextPageToken'
     page_message = gapi.got_total_items_msg('Browsers', '...\n')
     browsers = gapi.get_all_pages(cbcm.chromebrowsers(), 'list',
                          'browsers', page_message=page_message,
@@ -163,9 +164,10 @@ def print_():
                 titles.append(a_key)
         csv_rows.append(browser)
     if sort_headers:
-        display.sort_csv_titles(['name',], titles)
+        display.sort_csv_titles(['deviceId',], titles)
     display.write_csv_file(csv_rows, titles, 'Browsers', todrive)
 
+
 attributes = {
     'assetid': 'annotatedAssetId',
     'location': 'annotatedLocation',
@@ -195,3 +197,88 @@ def update():
                        customer=GC_Values[GC_CUSTOMER_ID], body=browser,
                        projection='BASIC', fields="deviceId")
     print(f'Updated browser {result["deviceId"]}')
+
+
+def createtoken():
+    cbcm = build()
+    body = {'token_type': 'CHROME_BROWSER'}
+    i = 3
+    while i < len(sys.argv):
+        myarg = sys.argv[i].lower().replace('_', '')
+        if myarg in ['ou', 'orgunit', 'org']:
+            body['org_unit_path'] = gapi_directory_orgunits.getOrgUnitItem(sys.argv[i + 1])
+            i += 2
+        elif myarg in ['expire', 'expires']:
+            body['expire_time'] = utils.get_time_or_delta_from_now(sys.argv[i + 1])
+            i += 2
+        else:
+            controlflow.invalid_argument_exit(sys.argv[i],
+                                              'gam create browsertoken')
+    browser = gapi.call(cbcm.enrollmentTokens(), 'create',
+                        customer=GC_Values[GC_CUSTOMER_ID], body=body)
+    print(f'Created browser enrollment token {browser["token"]}')
+
+
+def revoketoken():
+    cbcm = build()
+    token_permanent_id = sys.argv[3]
+    gapi.call(cbcm.enrollmentTokens(), 'revoke', tokenPermanentId=token_permanent_id,
+              customer=GC_Values[GC_CUSTOMER_ID])
+    print(f'Deleted browser enrollment token {token_permanent_id}')
+
+
+def printshowtokens(csvFormat):
+    cbcm = build()
+    query = None
+    fields = []
+    if csvFormat:
+        titles = ['token']
+        csv_rows = []
+        todrive = False
+        sort_headers = False
+    i = 3
+    while i < len(sys.argv):
+        myarg = sys.argv[i].lower().replace('_', '')
+        if myarg == 'query':
+            query = sys.argv[i+1]
+            i += 2
+        elif csvFormat and myarg == 'todrive':
+            todrive = True
+            i += 1
+        elif csvFormat and myarg == 'sortheaders':
+            sort_headers = True
+            i += 1
+        elif myarg == 'fields':
+            fields = sys.argv[i + 1].replace(',', ' ').split()
+            i += 2
+        else:
+            controlflow.invalid_argument_exit(sys.argv[i],
+                f"gam {['show', 'print'][csvFormat]} browsertokens")
+    if fields:
+        fields.append('token')
+        fields = f'chromeEnrollmentTokens({",".join(set(fields))}),nextPageToken'
+    page_message = gapi.got_total_items_msg('Chrome Browser Enrollment Tokens', '...\n')
+    browsers = gapi.get_all_pages(cbcm.enrollmentTokens(), 'list',
+                         'chromeEnrollmentTokens', page_message=page_message,
+                         customer=GC_Values[GC_CUSTOMER_ID],
+                         query=query, fields=fields)
+    if not csvFormat:
+        count = len(browsers)
+        print(f'Show {count} Chrome Browser Enrollment Tokens')
+        i = 0
+        for browser in browsers:
+            i += 1
+            print(f'  Chrome Browser Enrollment Token: {browser["token"]}{gam.currentCount(i, count)}')
+            browser.pop('kind', None)
+            for field in browser:
+                print(f'    {field}: {browser[field]}')
+    else:
+        for browser in browsers:
+            browser = utils.flatten_json(browser)
+            for a_key in browser:
+                if a_key not in titles:
+                    titles.append(a_key)
+            csv_rows.append(browser)
+        if sort_headers:
+            display.sort_csv_titles(['token',], titles)
+        display.write_csv_file(csv_rows, titles, 'Chrome Browser Enrollment Tokens', todrive)