Fixed bug in gam print|show cigroups cimember <UserItem>

Merge branch 'main' of https://github.com/GAM-team/GAM
Handle additional error when unsuspending a user
2026-06-14 03:01:36 +00:00 · 2025-07-21 15:54:39 -07:00 · 2025-07-21 14:07:07 -07:00 · 2025-07-21 14:07:03 -07:00 · 2025-07-21 20:49:24 +00:00 · 2025-07-21 16:13:18 -04:00
33 changed files with 1055 additions and 241 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -292,10 +292,10 @@ jobs:
        if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit != 'true'
        run: |
          cd "${OPENSSL_SOURCE_PATH}"
-          if ([ "$RUNNER_OS" == "Windows" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
+          #if ([ "$RUNNER_OS" == "Windows" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
            # https://github.com/openssl/openssl/issues/26239
            export CFLAGS=-DNO_INTERLOCKEDOR64
-          fi
+          #fi
          # --libdir=lib is needed so Python can find OpenSSL libraries
          "${PERL}" ./Configure --libdir=lib --prefix="${OPENSSL_INSTALL_PATH}" $OPENSSL_CONFIG_OPTS

@@ -462,7 +462,7 @@ jobs:
          curl -O -L "$latest_crypt_whl"
          "$PYTHON" -m pip install cryptography*.whl

-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      #- uses: actions-rust-lang/setup-rust-toolchain@v1

     # - name: Compile cryptography from source (no legacy)
     #   if: runner.os != 'Windows' || runner.arch != 'ARM64'
@@ -473,8 +473,7 @@ jobs:
        run: |
          echo "before anything..."
          "$PYTHON" -m pip list
-          "$PYTHON" -m pip install --upgrade -r requirements.txt
-          echo "after requirements..."
+          "$PYTHON" -m pip install --upgrade ..[yubikey]
          "$PYTHON" -m pip list
          #"$PYTHON" -m pip install --force-reinstall --no-deps --upgrade cryptography
          echo "after everything..."
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,8 @@ authors = [
    { name="Jay Lee", email="jay0lee@gmail.com" },
    { name="Ross Scroggs", email="Ross.Scroggs@gmail.com" },
 ]
-# # The following files should be edited to match: setup.cfg, requirements.txt
+# notice that yubikey-manager remains optional further down since it is less command and adds
+#significant compile dependencies.
 dependencies = [
    "chardet>=5.2.0",
    "cryptography>=44.0.2",
@@ -22,7 +23,6 @@ dependencies = [
    "passlib>=1.7.4",
    "pathvalidate>=3.2.3",
    "python-dateutil",
-    "yubikey-manager>=5.6.1",
 ]
 description = "CLI tool to manage Google Workspace"
 readme = "README.md"
--- a/src/GamCommands.txt
+++ b/src/GamCommands.txt
@@ -381,7 +381,7 @@ If an item contains spaces, it should be surrounded by ".
        domain:<DomainName>|domain|default
 <CalendarItem> ::= <EmailAddress>
 <ChannelCustomerID> ::= <String>
-<ChatEmojiName> ::= :<String>:
+<ChatEmojiName> ::= :[0-9a-z_-]+:
 <ChatEmoji> ::= emojiname <ChatEmojiName> | customemojis/<String>
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMessage> ::= spaces/<String>/messages/<String>
@@ -533,7 +533,6 @@ If an item contains spaces, it should be surrounded by ".
 <Password> ::= <String>
 <PeopleResourceName> ::= people/<String>
 <PrinterID> ::= <String>
-<ChromeProfileID> ::= <String>
 <ProjectID> ::= <String>
        Must match this Python Regular Expression: [a-z][a-z0-9-]{4,28}[a-z0-9]
 <ProjectName> ::= <String>
@@ -623,6 +622,14 @@ If an item contains spaces, it should be surrounded by ".
        gs://<StorageBucketName>/<StorageObjectName>|
        <StorageBucketName>/<StorageObjectName>
 <Tag> ::= <String>
+<TagManagerAccountID> ::= <String>
+<TagManagerAccountPath> ::= accounts/<TagManagerAccountID>
+<TagManagerContainerID> ::= <String>
+<TagManagerContainerPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>
+<TagManagerWorkspaceID> ::= <String>
+<TagManagerWorkspacePath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>
+<TagManagerTagID> ::= <String>
+<TagManagerTagPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>/tags/<TagManagerTagID>
 <TakeoutBucketName> ::= takeout-export-[a-f,0-9,-]*
 <TaskID> ::= <String>
 <TaskListID> ::= <String>
@@ -685,9 +692,16 @@ If an item contains spaces, it should be surrounded by ".
 <CalendarACLScopeList> ::= "<CalendarACLScope>(,<CalendarACLScope>)*"
 <CalendarList> ::= "<CalendarItem>(,<CalendarItem>)*"
 <ChatSpaceList> ::= "<ChatSpace>(,<ChatSpace>)*"
+<ChromeProfileNameList> ::= "<ChromeProfileName>(,<ChromeProfileName>)*"
+<ChromeProfileCommandNameList> ::= "<ChromeProfileCommandName>(,<ChromeProfileCommandName>)*"
 <CIGroupAliasList> ::= "<CIGroupAlias>(,<CIGroupAlias>)*"
 <CIGroupMemberTypeList> ::= "<CIGroupMemberType>(,<CIGroupMemberType>)*"
 <CIPolicyNameList> ::= "<CIPolicyName>(,<CIPolicyName>)*"
+<ClassificationLabelIDList> ::= "<ClassificationLabelID>(,<ClassificationLabelID>)*"
+<ClassificationLabelNameList> ::= "<ClassificationLabelName>(,<ClassificationLabelName>)*"
+<ClassificationLabelPermissionNameList> ::= "<ClassificationLabelPermissionName>(,<ClassificationLabelPermissionName>)*"
+<ClassificationLabelFieldIDList> ::= "<ClassificationLabelFieldID>(,<ClassificationLabelFieldID>)*"
+<ClassificationLabelSelectionIDList> ::= "<ClassificationLabelSelectionID>(,<ClassificationLabelSelectionID>)*"
 <ClassroomInvitationIDList> ::= "<ClassroomInvitationID>(,<ClassroomInvitationID>)*"
 <ContactGroupList> ::= "<ContactGroupItem>(,<ContactGroupItem>)*"
 <ContactIDList> ::= "<ContactID>(,<ContactID>)*"
@@ -765,6 +779,9 @@ If an item contains spaces, it should be surrounded by ".
 <SharedDriveACLRoleList> ::= "<SharedDriveACLRole>(,<SharedDriveACLRole>)*"
 <SharedDriveIDList> ::= "<SharedDriveID>(,<SharedDriveID>)*"
 <StringList> ::= "<String>(,<String>)*"
+<TagManagerAccountPathList> ::= "<TagManagerAccountPath>(,<TagManagerAccountPath>)*"
+<TagManagerContainerPathList> ::= "<TagManagerContainerPath>(,<TagManagerContainerPath>)*"
+<TagManagerWorkspacePathList> ::= "<TagManagerWorkspacePath>(,<TagManagerWorkspacePath>)*"
 <TasklistIDList> ::= "<TasklistID>(,<TasklistID>)*"
 <TasklistTitleList> ::= "'<TasklistTitle>'(,'<TasklistTitle>')*"
 <TasklistIDTaskIDList> ::= "<TasklistIDTaskID>(,<TasklistIDTaskID>)*"
@@ -1019,6 +1036,11 @@ Specify a collection of items by directly specifying them; the item type is dete
        <CalendarACLScopeList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 <CalendarEntity> ::=
        <CalendarList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]) |
+        (commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>)
 <CIPolicyNameEntity> ::=
        <CIPolicyNameList> | <FileSelector> | <CSVFileSelector>
 <ClassificationLabelNameEntity> ::=
@@ -1221,6 +1243,15 @@ Specify a collection of items by directly specifying them; the item type is dete
        <SiteACLScopeList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 <SiteEntity> ::=
        <SiteList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+<TagManagerAccountPathEntity> ::=
+        <TagManagerAccountPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+<TagManagerContainerPathEntity> ::=
+        <TagManagerContainerPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+<TagManagerWorkspacePathEntity> ::=
+        <TagManagerWorkspacePathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
 <TasklistEntity> ::=
        <TasklistIDList> | <TaskListTitleList> | <FileSelector> | <CSVFileSelector>
 <TasklistIDTaskIDEntity> ::=
@@ -2221,7 +2252,14 @@ gam show chromeneedsattn

 <ChromeProfilePermanentID> ::= <String>
 <ChromeProfileName> ::= customers/<CustomerID>/profiles/<ChromeProfilePermanentID> | <ChromeProfilePermanentID>
+<ChromeProfileNameList> ::= "<ChromeProfileName>(,<ChromeProfileName>)*"
 <ChromeProfileCommandName> ::= <ChomeProfileName>/commands/<String>
+<ChromeProfileCommandNameList> ::= "<ChromeProfileCommandName>(,<ChromeProfileCommandName>)*"
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <ChromeProfileNameList>|<FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]) |
+        (commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>)

 <ChromeProfileFieldName> ::=
        affiliationstate|
@@ -2273,26 +2311,26 @@ gam delete chromeprofile <ChromeProfileName>
 gam info chromeprofile <ChromeProfileName>
        <ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
 gam show chromeprofiles
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]
        <ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
        [formatjson]
 gam print chromeprofiles [todrive <ToDriveAttribute>*]
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]
        <ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
        [formatjson [quotechar <Character>]]

-gam create chromeprofilecommand <ChromeProfileName>
+gam create chromeprofilecommand <ChromeProfileNameEntity>
        [clearcache [<Boolean>]] [clearcookies [<Boolean>]]
-        [formatjson]
+        [csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]

 gam info chromeprofilecommand <ChromeProfileCommandName>
        [formatjson]

-gam show chromeprofilecommands <ChromeProfileName>
+gam show chromeprofilecommands <ChromeProfileNameEntity>
        [formatjson]
-gam print chromeprofilecommands <ChromeProfileName> [todrive <ToDriveAttribute>*]
+gam print chromeprofilecommands <ChromeProfileNameEntity> [todrive <ToDriveAttribute>*]
        [formatjson [quotechar <Character>]]

 # Chrome Versions Counts
@@ -3432,8 +3470,7 @@ gam print|show transferapps

 <DataTransferService> ::=
        calendar|
-        currents|
-        datastudio|lookerstudio|"google data studio"|
+        datastudio|lookerstudio|"looker studio"|
        googledrive|gdrive|drive|"drive and docs"
 <DataTransferServiceList> ::= "<DataTransferService>(,<DataTransferService>)*"

@@ -4511,7 +4548,7 @@ gam report <ActivityApplicationName> [todrive <ToDriveAttribute>*]
        [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
        [([start <Time>] [end <Time>])|(range <Time> <Time>)|
         yesterday|today|thismonth|(previousmonths <Integer>)]
-        [filtertime.<String> <Time>] [filter|filters <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [event|events <EventNameList>] [ip <String>]
        [groupidfilter <String>]
        [maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
@@ -4558,7 +4595,7 @@ gam report users|user [todrive <ToDriveAttribute>*]
        [(date <Date>)|(range <Date> <Date>)|
          yesterday|today|thismonth|(previousmonths <Integer>)]
        [(nodatechange | limitdatechanges <Integer>) | (fulldatarequired all|<UserServiceNameList>)]
-        [filtertime.* <Time>] [filter|filters <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [(fields|parameters <String>)|(services <UserServiceNameList>)]
        [aggregatebydate|aggregatebyuser [Boolean]]
        [maxresults <Number>]
@@ -7486,10 +7523,10 @@ gam <UserTypeEntity> show forms <DriveFileEntity>

 gam <UserTypeEntity> print formresponses <DriveFileEntity> [todrive <ToDriveAttribute>*]
        (addcsvdata <FieldName> <String>)*
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [countsonly|(formatjson [quotechar <Character>])]
 gam <UserTypeEntity> show formresponses <DriveFileEntity>
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [countsonly|formatjson]

 # Users - Gmail - Forwarding
@@ -8323,6 +8360,59 @@ gam <UserTypeEntity> profile share|shared|unshare|unshared

 gam <UserTypeEntity> show profile

+# Users - Tag Manager
+
+<TagManagerAccountID> ::= <String>
+<TagManagerAccountPath> ::= accounts/<TagManagerAccountID>
+<TagManagerAccountPathList> ::= "<TagManagerAccountPath>(,<TagManagerAccountPath>)*"
+<TagManagerAccountPathEntity> ::=
+        <TagManagerAccountPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+
+<TagManagerContainerID> ::= <String>
+<TagManagerContainerPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>
+<TagManagerContainerPathList> ::= "<TagManagerContainerPath>(,<TagManagerContainerPath>)*"
+<TagManagerContainerPathEntity> ::=
+        <TagManagerContainerPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+
+<TagManagerWorkspaceID> ::= <String>
+<TagManagerWorkspacePath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>
+<TagManagerWorkspacePathList> ::= "<TagManagerWorkspacePath>(,<TagManagerWorkspacePath>)*"
+<TagManagerWorkspacePathEntity> ::=
+        <TagManagerWorkspacePathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+
+<TagManagerTagID> ::= <String>
+<TagManagerTagPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>/tags/<TagManagerTagID>
+
+gam <UserTypeEntity> show tagmanageraccounts
+        [includegoogletags [<Boolean>]]
+        [formatjson]
+gam <UserTypeEntity> print tagmanagerccounts [todrive <ToDriveAttribute>*]
+        [includegoogletags [<Boolean>]]
+        [formatjson [quotechar <Character>]]
+
+gam <UserTypeEntity> show tagmanagercontainers <TagManagerAccountPathEntity>
+        [formatjson]
+gam <UserTypeEntity> print tagmanagercontainers <TagManagerAccountPathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+
+gam <UserTypeEntity> show tagmanagerworkspaces <TagManagerContainerPathEntity>
+        [formatjson]
+gam <UserTypeEntity> print tagmanagerworkspaces <TagManagerContainerPathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+
+gam <UserTypeEntity> show tagmanagertags <TagManagerWorkspacePathEntity>
+        [formatjson]
+gam <UserTypeEntity> print tagmanagertags <TagManagerWorkspacePathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+
+gam <UserTypeEntity> show tagmanagerpermissions <TagManagerAccountPathEntity>
+        [formatjson]
+gam <UserTypeEntity> print tagmanagerpermissions <TagManagerAccountPathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+
 # Users - Tasks

 <TaskAttribute> ::=
--- a/src/GamUpdate.txt
+++ b/src/GamUpdate.txt
@@ -1,3 +1,74 @@
+7.14.04
+
+Fixed bug in `gam print|show cigroups cimember <UserItem>` that generated the following error:
+```
+ERROR: Cloud Identity Group: groups/-, Print Failed: Error(4013): Insufficient permissions to retrieve memberships.
+```
+
+Updated `gam <UserTypeEntity> update user suspended off` and `gam <UserTypeEntity> unsuspend users`
+to handle the following error that occurs when trying to unsuspend a user that has been suspended for abuse.
+```
+ERROR: 412: adminCannotUnsuspend - Cannot restore a user suspended for abuse.
+```
+
+* See: https://support.google.com/a/answer/1110339
+
+7.14.03
+
+Fixed bug in `gam print cigroup-members includederivedmembership` that caused a trap.
+
+7.14.02
+
+Fixed bug in `gam print|show cigroups|cigroups-members cimember <UserItem>` that generated the following error:
+```
+Cloud Identity Group Print Failed: Request contains an invalid argument.
+```
+
+7.14.01
+
+Don't install yubikey library via pip by default. To install with yubikey support use pip install gam7[yubikey]
+
+7.14.00
+
+Added commands to display Google Tag Manager accounts, containers, workspaces, tags and user permissions.
+
+* See: https://github.com/GAM-team/GAM/wiki/Users-Tag-Manager
+
+7.13.03
+
+Added option `csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]`
+to `gam create chromeprofilecommand` so that command details are displayed in CSV format.
+
+Added option `commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>` to `<ChromeProfileNameEntity>`
+so that `gam print|show chromeprofilecommands` can directly display the commands generated by
+`gam create chromeprofilecommand` with the `csv` option.
+
+7.13.02
+
+Fixed bug in `gam create chromeprofilecommand` where `select|filter` were not recognized.
+
+Updated `gam create datatransfer <OldOwnerID> datastudio <NewOwnerID>` that generated the following
+error due to an unhandled API change.
+```
+ERROR: Invalid choice (google data studio): Expected <calendar|looker studio|drive and docs>
+```
+
+7.13.01
+
+Enhanced `gam create|print|show chromeprofilecommand` to allow specification
+of multiple Chrome browser profiles rather than just one.
+```
+<ChromeProfilePermanentID> ::= <String>
+<ChromeProfileName> ::= customers/<CustomerID>/profiles/<ChromeProfilePermanentID> | <ChromeProfilePermanentID>
+<ChromeProfileNameList> ::= "<ChromeProfileName>(,<ChromeProfileName>)*"
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]])
+
+gam create|print_show chromeprofilecommand <ChromeProfileNameEntity>
+```
+
 7.13.00

 Added commands that send remote commands to Chrome browser profiles and display the results;
@@ -12807,7 +12878,7 @@ gam <UserTypeEntity> update teamdrive <TeamDriveEntity> [adminaccess|asadmin] [n
 Updated gam report users to support new orgUnitID argument in Reports API.

 gam report users|user [todrive <ToDriveAttribute>*] [date <Date>] [nodatechange | (fulldatarequired all|<ReportsAppList>)]
-        [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath>)|(select <UserTypeEntity>)] (filtertime.* <Time>)* [filter|filters <String>] [fields|parameters <String>]
+        [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath>)|(select <UserTypeEntity>)] (filtertime<String> <Time>)* [filter|filters <String>] [fields|parameters <String>]
        [maxactivities <Number>] [maxresults <Number>]

 Select the users for whom information is desired.
@@ -13398,15 +13469,15 @@ gam print cros query "sync:#querytime1#.." querytime1 -30d
 For example, to print information about CrOS devices synced between 45 days ago and 30 days ago:
 gam print cros query "sync:#querytime1#..#querytime2#" querytime1 -45d querytime2 -30d

-Added filtertime.* <Time> option to gam report to allow times, usually relative, to be substituted into the filter <String> option.
-The filtertime.* value replaces the string #filtertime.*# in the filter <String>.
+Added filtertime<String> <Time> option to gam report to allow times, usually relative, to be substituted into the filter <String> option.
+The filtertime<String> value replaces the string #filtertime<String># in the filter <String>.
 The characters following filtertime can be any combination of lowercase letters and numbers.
    gam report users|user [todrive <ToDriveAttribute>*] [date <Date>] [nodatechange | (fulldatarequired all|<ReportsAppList>)]
-        [(user all|<UserItem>)|(select <UserTypeEntity>)] (filtertime.* <Time>)* [filter|filters <String>] [fields|parameters <String>]
+        [(user all|<UserItem>)|(select <UserTypeEntity>)] (filtertime<String> <Time>)* [filter|filters <String>] [fields|parameters <String>]
        [maxactivities <Number>] [maxresults <Number>]
    gam report admin|calendar|calendars|drive|docs|doc|gplus|groups|group|logins|login|mobile|rules|tokens|token [todrive <ToDriveAttribute>*] [maxresults <Number>] [maxactivities <Number>]
        [([start <Time>] [end <Time>])|yesterday] [(user all|<UserItem>)|(select <UserTypeEntity>)]
-        [event <String>] (filtertime.* <Time>)* [filter|filters <String>] [ip <String>] [countsonly] [summary]
+        [event <String>] (filtertime<String> <Time>)* [filter|filters <String>] [ip <String>] [countsonly] [summary]

 For example, this command reports on the users that haven't logged in in the last 5 years.
 gam report users parameters accounts:last_login_time filters "accounts:last_login_time<#filtertime#" filtertime -5y
@@ -13562,21 +13633,21 @@ Added units of years to <Date>, <DateTime> and <Time>; a year is 365 days. Added
        never|
        now|today

-Added filtertime <Time> option to gam report to allow times, usually relative, to be substituted into the filter <String> option.
-If both filtertime and filter are specified, the filtertime value replaces the string #filtertime# in the filter <String>.
+Added filtertime<String> <Time> option to gam report to allow times, usually relative, to be substituted into the filter <String> option.
+If both filtertime<String> and filter are specified, the filtertime value replaces the string #filtertime<String># in the filter <String>.

 gam report users|user [todrive <ToDriveAttribute>*] [date <Date>] [nodatechange | (fulldatarequired all|<ReportsAppList>)]
-        [(user all|<UserItem>)|(select <UserTypeEntity>)] [filtertime <Time>] [filter|filters <String>] [fields|parameters <String>]
+        [(user all|<UserItem>)|(select <UserTypeEntity>)] [filtertime<String> <Time>] [filter|filters <String>] [fields|parameters <String>]
        [maxactivities <Number>] [maxresults <Number>]
 gam report admin|calendar|calendars|drive|docs|doc|gplus|groups|group|logins|login|mobile|rules|tokens|token [todrive <ToDriveAttribute>*] [maxresults <Number>] [maxactivities <Number>]
        [([start <Time>] [end <Time>])|yesterday] [(user all|<UserItem>)|(select <UserTypeEntity>)]
-        [event <String>] [filtertime <Time>] [filter|filters <String>] [ip <String>] [countsonly] [summary]
+        [event <String>] [filtertime<String> <Time>] [filter|filters <String>] [ip <String>] [countsonly] [summary]

 For example, this command reports on the users that haven't logged in in the last 5 years.
-gam report users parameters accounts:last_login_time filters "accounts:last_login_time<#filtertime#" filtertime -5y
+gam report users parameters accounts:last_login_time filters "accounts:last_login_time<#filtertime5y#" filtertime5y -5y

 For example, this command reports on the users that haven't ever logged in.
-gam report users parameters accounts:last_login_time filters "accounts:last_login_time==#filtertime#" filtertime never
+gam report users parameters accounts:last_login_time filters "accounts:last_login_time==#filtertimeNever#" filtertimeNever never

 4.60.14

--- a/src/gam/init.py
+++ b/src/gam/init.py
@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """

 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.13.00'
+__version__ = '7.14.04'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'

 #pylint: disable=wrong-import-position
@@ -6011,7 +6011,11 @@ def getCIGroupMemberRoleFixType(member):
 def getCIGroupTransitiveMemberRoleFixType(groupName, tmember):
  ''' map transitive member to normal member '''
  tid = tmember['preferredMemberKey'][0].get('id', GC.Values[GC.CUSTOMER_ID]) if tmember['preferredMemberKey'] else ''
-  ttype, tname = tmember['member'].split('/')
+  if '/' in tmember['member']:
+    ttype, tname = tmember['member'].split('/')
+  else:
+    ttype = ''
+    tname = tmember['member']
  member = {'name': f'{groupName}/membershipd/{tname}', 'preferredMemberKey': {'id': tid}}
  if 'type' not in tmember:
    if tid == GC.Values[GC.CUSTOMER_ID]:
@@ -6106,7 +6110,7 @@ def getCIGroupMembershipGraph(ci, member):
    result = callGAPI(ci.groups().memberships(), 'getMembershipGraph',
                      throwReasons=GAPI.CIGROUP_LIST_THROW_REASONS, retryReasons=GAPI.CIGROUP_RETRY_REASONS,
                      parent=parent,
-                      query=f"member_key_id == '{member}' && CIGROUP_DISCUSSION_FORUM_LABEL in labels")
+                      query=f"member_key_id == '{member}' && '{CIGROUP_DISCUSSION_FORUM_LABEL}' in labels")
    return (ci, result.get('response', {}))
  except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis,
          GAPI.forbidden, GAPI.badRequest, GAPI.invalid, GAPI.invalidArgument,
@@ -13641,7 +13645,7 @@ REPORT_ACTIVITIES_TIME_OBJECTS = {'time'}
 #	[(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
 #	[([start <Time>] [end <Time>])|(range <Time> <Time>)|
 #	 yesterday|today|thismonth|(previousmonths <Integer>)]
-#	[filtertime.* <Time>] [filter|filters <String>]
+#	[filter <String> (filtertime<String> <Time>)*]
 #	[event|events <EventNameList>] [ip <String>]
 #	[groupidfilter <String>]
 #	[maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
@@ -13653,7 +13657,7 @@ REPORT_ACTIVITIES_TIME_OBJECTS = {'time'}
 #	[(date <Date>)|(range <Date> <Date>)|
 #	 yesterday|today|thismonth|(previousmonths <Integer>)]
 #	[nodatechange | (fulldatarequired all|<UserServiceNameList>)]
-#	[filtertime.* <Time>] [filter|filters <String>]
+#	[filter <String> (filtertime<String> <Time>)*]
 #	[(fields|parameters <String>)|(services <UserServiceNameList>)]
 #	[aggregatebydate|aggregatebyuser [Boolean]]
 #	[maxresults <Number>]
@@ -17071,14 +17075,14 @@ def _convertTransferAppIDtoName(apps, appID):
  return f'applicationId: {appID}'

 DRIVE_AND_DOCS_APP_NAME = 'drive and docs'
-GOOGLE_DATA_STUDIO_APP_NAME = 'google data studio'
+GOOGLE_LOOKER_STUDIO_APP_NAME = 'looker studio'

 SERVICE_NAME_CHOICE_MAP = {
-  'datastudio': GOOGLE_DATA_STUDIO_APP_NAME,
+  'datastudio': GOOGLE_LOOKER_STUDIO_APP_NAME,
  'drive': DRIVE_AND_DOCS_APP_NAME,
  'googledrive': DRIVE_AND_DOCS_APP_NAME,
  'gdrive': DRIVE_AND_DOCS_APP_NAME,
-  'lookerstudio': GOOGLE_DATA_STUDIO_APP_NAME,
+  'lookerstudio': GOOGLE_LOOKER_STUDIO_APP_NAME,
  }

 def _validateTransferAppName(apps, appName):
@@ -24113,7 +24117,10 @@ def infoCrOSDevices(entityList):
        printKeyValueList([up, ''])
        Ind.Increment()
        for key, value in sorted(iter(cros[up].items())):
-          printKeyValueList([key, value])
+          if key not in CROS_TIME_OBJECTS:
+            printKeyValueList([key, value])
+          else:
+            printKeyValueList([key, formatLocalTime(value)])
        Ind.Decrement()
    if not noLists:
      activeTimeRanges = _filterActiveTimeRanges(cros, True, listLimit, startDate, endDate, activeTimeRangesOrder)
@@ -25491,7 +25498,7 @@ def doUpdateBrowsers():
      checkEntityAFDNEorAccessErrorExit(None, Ent.CHROME_BROWSER, deviceId, i, count)

 def _getChromeProfileName():
-  profileName = getString(Cmd.OB_CHROMEPROFILE_ID)
+  profileName = getString(Cmd.OB_CHROMEPROFILE_NAME)
  if not profileName.startswith('customers'):
    customerId = _getCustomerId()
    profileName = f'customers/{customerId}/profiles/{profileName}'
@@ -25598,12 +25605,12 @@ CHROMEPROFILE_ORDERBY_CHOICE_MAP = {
  }

 # gam show chromeprofiles
-#	[filtertime.* <Time>] [filter <String>]
+#	[filter <String> (filtertime<String> <Time>)*]
 #	[orderby <ChromeProfileOrderByFieldName> [ascending|descending]]
 #	<ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
 #	[formatjson]
 # gam print chromeprofiles [todrive <ToDriveAttribute>*]
-#	[filtertime.* <Time>] [filter <String>]
+#	[filter <String> (filtertime<String> <Time>)*]
 #	[orderby <ChromeProfileOrderByFieldName> [ascending|descending]]
 #	<ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
 #	[formatjson [quotechar <Character>]]
@@ -25641,7 +25648,7 @@ def doPrintShowChromeProfiles():
      sortHeaders = True
    else:
      FJQC.GetFormatJSONQuoteChar(myarg, True)
-  if filterTimes and filter is not None:
+  if filterTimes and cbfilter is not None:
    for filterTimeName, filterTimeValue in iter(filterTimes.items()):
      cbfilter = cbfilter.replace(f'#{filterTimeName}#', filterTimeValue)
  fields = getItemFieldsFromFieldsList('chromeBrowserProfiles', fieldsList)
@@ -25676,6 +25683,64 @@ def doPrintShowChromeProfiles():
      csvPF.SetSortTitles(['name', 'profileId'])
    csvPF.writeCSVfile('Chrome Profiles')

+def _getChromeProfileNameList():
+  if not Cmd.PeekArgumentPresent(['select', 'commands', 'filter', 'filters']):
+    return getString(Cmd.OB_CHROMEPROFILE_NAME_LIST).replace(',', ' ').split()
+  return []
+
+def _initChromeProfileNameParameters():
+  cm = buildGAPIObject(API.CHROMEMANAGEMENT)
+  return (cm, {'profileNameList': _getChromeProfileNameList(),
+               'commandNameList': [],
+               'customerId': _getCustomerId(),
+               'cbfilter': None, 'filterTimes': {},
+               'OBY': OrderBy(CHROMEPROFILE_ORDERBY_CHOICE_MAP)})
+
+def _getChromeProfileNameParameters(myarg, parameters):
+  if not parameters['cbfilter'] and not parameters['commandNameList'] and myarg == 'select':
+    parameters['profileNameList'].extend(getEntityList(Cmd.OB_CHROMEPROFILE_NAME_LIST))
+  elif not parameters['cbfilter'] and not parameters['profileNameList'] and myarg == 'commands':
+    parameters['commandNameList'].extend(getEntityList(Cmd.OB_CHROMEPROFILE_COMMAND_NAME_LIST))
+  elif not parameters['profileNameList'] and not parameters['commandNameList'] and myarg == 'orderby':
+    parameters['OBY'].GetChoice()
+  elif not parameters['profileNameList'] and not parameters['commandNameList'] and myarg.startswith('filtertime'):
+    parameters['filterTimes'][myarg] = getTimeOrDeltaFromNow()
+  elif not parameters['profileNameList'] and not parameters['commandNameList'] and myarg in {'filter', 'filters'}:
+    parameters['cbfilter'] = getString(Cmd.OB_STRING)
+  else:
+    return False
+  return True
+
+def _getChromeProfileNameEntityForCommand(cm, parameters):
+  if parameters['cbfilter'] is None:
+    customerId = parameters['customerId']
+    if parameters['profileNameList']:
+      for i, profileName in enumerate(parameters['profileNameList']):
+        if not profileName.startswith('customers'):
+          parameters['profileNameList'][i] = f'customers/{customerId}/profiles/{profileName}'
+    elif parameters['commandNameList']:
+      for i, commandName in enumerate(parameters['commandNameList']):
+        if not commandName.startswith('customers'):
+          parameters['commandNameList'][i] = f'customers/{customerId}/profiles/{commandName}'
+    return
+  if parameters['filterTimes']:
+    for filterTimeName, filterTimeValue in iter(parameters['filterTimes'].items()):
+      parameters['cbfilter'] = parameters['cbfilter'].replace(f'#{filterTimeName}#', filterTimeValue)
+  printGettingAllAccountEntities(Ent.CHROME_PROFILE, parameters['cbfilter'])
+  pageMessage = getPageMessage()
+  try:
+    feed = yieldGAPIpages(cm.customers().profiles(), 'list', 'chromeBrowserProfiles',
+                          pageMessage=pageMessage,
+                          throwReasons=[GAPI.INVALID_ARGUMENT, GAPI.PERMISSION_DENIED],
+                          parent=f'customers/{parameters["customerId"]}', pageSize=200,
+                          filter=parameters['cbfilter'], orderBy=parameters['OBY'].orderBy,
+                          fields='nextPageToken,chromeBrowserProfiles(name)')
+    for profiles in feed:
+      for profile in profiles:
+        parameters['profileNameList'].append(profile['name'])
+  except (GAPI.invalidArgument, GAPI.permissionDenied) as e:
+    entityActionFailedExit([Ent.CHROME_PROFILE, parameters['cbfilter']], str(e))
+
 CHROMEPROFILECOMMAND_TIME_OBJECTS = {
  'clientExecutionTime',
  'issueTime',
@@ -25691,29 +25756,57 @@ def _showChromeProfileCommand(profcmd, FJQC, i=0, count=0):
  showJSON(None, profcmd, timeObjects=CHROMEPROFILECOMMAND_TIME_OBJECTS)
  Ind.Decrement()

-# gam create chromeprofilecommand <ChromeProfileName>
+def _printChromeProfileCommand(profcmd, csvPF, FJQC):
+  row = flattenJSON(profcmd, timeObjects=CHROMEPROFILECOMMAND_TIME_OBJECTS)
+  if not FJQC.formatJSON:
+    csvPF.WriteRowTitles(row)
+  elif csvPF.CheckRowTitles(row):
+    csvPF.WriteRowNoFilter({'name': profcmd['name'],
+                            'JSON': json.dumps(cleanJSON(profcmd, timeObjects=CHROMEPROFILECOMMAND_TIME_OBJECTS),
+                                               ensure_ascii=False, sort_keys=True)})
+
+# gam create chromeprofilecommand <ChromeProfileNameEntity>
 #	[clearcache [<Boolean>]] [clearcookies [<Boolean>]]
-#	[formatjson]
+#	[csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]
 def doCreateChromeProfileCommand():
-  cm = buildGAPIObject(API.CHROMEMANAGEMENT)
-  profileName = _getChromeProfileName()
+  cm, parameters = _initChromeProfileNameParameters()
  body = {'commandType': 'clearBrowsingData', 'payload': {}}
-  FJQC = FormatJSONQuoteChar()
+  csvPF = None
+  FJQC = FormatJSONQuoteChar(None)
  while Cmd.ArgumentsRemaining():
    myarg = getArgument()
-    if myarg == 'clearcache':
+    if _getChromeProfileNameParameters(myarg, parameters):
+      pass
+    elif myarg == 'clearcache':
      body['payload']['clearCache'] = getBoolean()
    elif myarg == 'clearcookies':
      body['payload']['clearCookies'] = getBoolean()
+    elif myarg == 'csv':
+      csvPF = CSVPrintFile(['name'], 'sortall')
+      FJQC.SetCsvPF(csvPF)
+    elif csvPF and myarg == 'todrive':
+      csvPF.GetTodriveParameters()
    else:
-      FJQC.GetFormatJSON(myarg)
-  try:
-    profcmd = callGAPI(cm.customers().profiles().commands(), 'create',
-                       throwReasons=[GAPI.INVALID_ARGUMENT, GAPI.NOT_FOUND, GAPI.PERMISSION_DENIED],
-                       parent=profileName, body=body)
-    _showChromeProfileCommand(profcmd, FJQC)
-  except (GAPI.invalidArgument, GAPI.notFound, GAPI.permissionDenied) as e:
-    entityActionFailedExit([Ent.CHROME_PROFILE_COMMAND, profileName], str(e))
+      FJQC.GetFormatJSONQuoteChar(myarg, True)
+  _getChromeProfileNameEntityForCommand(cm, parameters)
+  count = len(parameters['profileNameList'])
+  i = 0
+  for profileName in parameters['profileNameList']:
+    i +=1
+    try:
+      profcmd = callGAPI(cm.customers().profiles().commands(), 'create',
+                         throwReasons=[GAPI.INVALID_ARGUMENT, GAPI.NOT_FOUND, GAPI.PERMISSION_DENIED],
+                         parent=profileName, body=body)
+      if csvPF is None:
+        _showChromeProfileCommand(profcmd, FJQC, i, count)
+      else:
+        _printChromeProfileCommand(profcmd, csvPF, FJQC)
+    except (GAPI.notFound) as e:
+      entityActionFailedWarning([Ent.CHROME_PROFILE_COMMAND, profileName], str(e), i, count)
+    except (GAPI.invalidArgument, GAPI.permissionDenied) as e:
+      entityActionFailedExit([Ent.CHROME_PROFILE_COMMAND, profileName], str(e))
+  if csvPF:
+    csvPF.writeCSVfile('Chrome Profile Commands')

 # gam info chromeprofilecommand <ChromeProfileCommandName>
 #	[formatjson]
@@ -25732,53 +25825,67 @@ def doInfoChromeProfileCommand():
  except (GAPI.invalidArgument, GAPI.notFound, GAPI.permissionDenied) as e:
    entityActionFailedExit([Ent.CHROME_PROFILE, profileCommandName], str(e))

-# gam show chromeprofilecommands <ChromeProfileName>
+# gam show chromeprofilecommands <ChromeProfileNameEntity>
 #	[formatjson]
-# gam print chromeprofilecommands <ChromeProfileName> [todrive <ToDriveAttribute>*]
+# gam print chromeprofilecommands <ChromeProfilNameEntity> [todrive <ToDriveAttribute>*]
 #	[formatjson [quotechar <Character>]]
 def doPrintShowChromeProfileCommands():
-  def _printProfileCommand(profcmd):
-    row = flattenJSON(profcmd, timeObjects=CHROMEPROFILECOMMAND_TIME_OBJECTS)
-    if not FJQC.formatJSON:
-      csvPF.WriteRowTitles(row)
-    elif csvPF.CheckRowTitles(row):
-      csvPF.WriteRowNoFilter({'name': profcmd['name'],
-                              'JSON': json.dumps(cleanJSON(profcmd, timeObjects=CHROMEPROFILECOMMAND_TIME_OBJECTS),
-                                                 ensure_ascii=False, sort_keys=True)})
-
-  cm = buildGAPIObject(API.CHROMEMANAGEMENT)
  csvPF = CSVPrintFile(['name']) if Act.csvFormat() else None
  FJQC = FormatJSONQuoteChar(csvPF)
-  profileName = _getChromeProfileName()
+  cm, parameters = _initChromeProfileNameParameters()
  while Cmd.ArgumentsRemaining():
    myarg = getArgument()
    if csvPF and myarg == 'todrive':
      csvPF.GetTodriveParameters()
+    elif _getChromeProfileNameParameters(myarg, parameters):
+      pass
    else:
      FJQC.GetFormatJSONQuoteChar(myarg, True)
-  printGettingEntityItemForWhom(Ent.CHROME_PROFILE_COMMAND, profileName)
-  pageMessage = getPageMessage()
-  try:
-    feed = yieldGAPIpages(cm.customers().profiles().commands(), 'list', 'chromeBrowserProfileCommands',
-                          pageMessage=pageMessage,
-                          throwReasons=[GAPI.NOT_FOUND, GAPI.INVALID_ARGUMENT, GAPI.PERMISSION_DENIED],
-                          parent=profileName, pageSize=100)
-    for profcmds in feed:
-      if not csvPF:
-        jcount = len(profcmds)
-        if not FJQC.formatJSON:
-          performActionNumItems(jcount, Ent.CHROME_PROFILE_COMMAND)
-        Ind.Increment()
-        j = 0
-        for profcmd in profcmds:
-          j += 1
-          _showChromeProfileCommand(profcmd, FJQC, j, jcount)
-        Ind.Decrement()
-      else:
-        for profcmd in profcmds:
-          _printProfileCommand(profcmd)
-  except (GAPI.notFound, GAPI.invalidArgument, GAPI.permissionDenied) as e:
-    entityActionFailedExit([Ent.CHROME_PROFILE, profileName], str(e))
+  _getChromeProfileNameEntityForCommand(cm, parameters)
+  if parameters['profileNameList']:
+    count = len(parameters['profileNameList'])
+    i = 0
+    for profileName in parameters['profileNameList']:
+      i +=1
+      printGettingEntityItemForWhom(Ent.CHROME_PROFILE_COMMAND, profileName, i, count)
+      pageMessage = getPageMessage()
+      try:
+        profcmds = callGAPIpages(cm.customers().profiles().commands(), 'list', 'chromeBrowserProfileCommands',
+                                 pageMessage=pageMessage,
+                                 throwReasons=[GAPI.NOT_FOUND, GAPI.INVALID_ARGUMENT, GAPI.PERMISSION_DENIED],
+                                 parent=profileName, pageSize=100)
+        if not csvPF:
+          jcount = len(profcmds)
+          Ind.Increment()
+          j = 0
+          for profcmd in profcmds:
+            j += 1
+            _showChromeProfileCommand(profcmd, FJQC, j, jcount)
+          Ind.Decrement()
+        else:
+          for profcmd in profcmds:
+            _printChromeProfileCommand(profcmd, csvPF, FJQC)
+      except GAPI.notFound as e:
+        entityActionFailedWarning([Ent.CHROME_PROFILE, profileName], str(e), i, count)
+      except (GAPI.invalidArgument, GAPI.permissionDenied) as e:
+        entityActionFailedExit([Ent.CHROME_PROFILE, profileName], str(e))
+  elif parameters['commandNameList']:
+    count = len(parameters['commandNameList'])
+    i = 0
+    for profileCommandName in parameters['commandNameList']:
+      i +=1
+      try:
+        profcmd = callGAPI(cm.customers().profiles().commands(), 'get',
+                           throwReasons=[GAPI.INVALID_ARGUMENT, GAPI.NOT_FOUND, GAPI.PERMISSION_DENIED],
+                           name=profileCommandName)
+        if not csvPF:
+          _showChromeProfileCommand(profcmd, FJQC, i, count)
+        else:
+          _printChromeProfileCommand(profcmd, csvPF, FJQC)
+      except GAPI.notFound as e:
+        entityActionFailedWarning([Ent.CHROME_PROFILE_COMMAND, profileCommandName], str(e), i, count)
+      except (GAPI.invalidArgument, GAPI.permissionDenied) as e:
+        entityActionFailedExit([Ent.CHROME_PROFILE, profileCommandName], str(e))
  if csvPF:
    csvPF.writeCSVfile('Chrome Profile Commands')

@@ -36725,11 +36832,11 @@ def doPrintCIGroups():

  ci = buildGAPIObject(API.CLOUDIDENTITY_GROUPS)
  setTrueCustomerId()
+  parent = f'customers/{GC.Values[GC.CUSTOMER_ID]}'
  delimiter = GC.Values[GC.CSV_OUTPUT_FIELD_DELIMITER]
  memberRestrictions = sortHeaders = False
  memberDisplayOptions = initPGGroupMemberDisplayOptions()
  pageSize = 500
-  parent = f'customers/{GC.Values[GC.CUSTOMER_ID]}'
  groupFieldsLists = {'ci': ['groupKey']}
  csvPF = CSVPrintFile(['email'])
  FJQC = FormatJSONQuoteChar(csvPF)
@@ -36747,7 +36854,7 @@ def doPrintCIGroups():
      showOwnedBy = convertUIDtoEmailAddress(getEmailAddress(), emailTypes=['user'])
    elif myarg in {'cimember', 'enterprisemember', 'ciowner'}:
      emailAddress = convertUIDtoEmailAddress(getEmailAddress(), emailTypes=['user', 'group'])
-      memberQuery = f"member_key_id == '{emailAddress}' && CIGROUP_DISCUSSION_FORUM_LABEL in labels"
+      memberQuery = f"member_key_id == '{emailAddress}' && '{CIGROUP_DISCUSSION_FORUM_LABEL}' in labels && parent == '{parent}'"
      entitySelection = None
      if myarg == 'ciowner':
        showOwnedBy = emailAddress
@@ -36993,7 +37100,7 @@ def getCIGroupTransitiveMembers(ci, groupName, membersList, i, count):
    entityUnknownWarning(Ent.CLOUD_IDENTITY_GROUP, groupName, i, count)
    return False
  except GAPI.permissionDenied as e:
-    entityActionFailedExit([Ent.CLOUD_IDENTITY_GROUP, groupName], str(e))
+    entityActionFailedWarning([Ent.CLOUD_IDENTITY_GROUP, groupName], str(e))
    return False
  for member in groupMembers:
    membersList.append(getCIGroupTransitiveMemberRoleFixType(groupName, member))
@@ -37149,6 +37256,7 @@ def _getCIListGroupMembersArgs(listView):
 def doPrintCIGroupMembers():
  ci = buildGAPIObject(API.CLOUDIDENTITY_GROUPS)
  setTrueCustomerId()
+  parent = f'customers/{GC.Values[GC.CUSTOMER_ID]}'
  memberOptions = initMemberOptions()
  memberDisplayOptions = initIPSGMGroupMemberDisplayOptions()
  groupColumn = True
@@ -37170,7 +37278,7 @@ def doPrintCIGroupMembers():
      showOwnedBy = convertUIDtoEmailAddress(getEmailAddress(), emailTypes=['user'])
    elif myarg in {'cimember', 'enterprisemember', 'ciowner'}:
      emailAddress = convertUIDtoEmailAddress(getEmailAddress(), emailTypes=['user', 'group'])
-      query = f"member_key_id == '{emailAddress}' && CIGROUP_DISCUSSION_FORUM_LABEL in labels"
+      query = f"member_key_id == '{emailAddress}' && '{CIGROUP_DISCUSSION_FORUM_LABEL}' in labels && parent == '{parent}'"
      entityList = None
      if myarg == 'ciowner':
        showOwnedBy = emailAddress
@@ -37372,6 +37480,7 @@ def doShowCIGroupMembers():

  ci = buildGAPIObject(API.CLOUDIDENTITY_GROUPS)
  setTrueCustomerId()
+  parent = f'customers/{GC.Values[GC.CUSTOMER_ID]}'
  subTitle = f'{Msg.ALL} {Ent.Plural(Ent.CLOUD_IDENTITY_GROUP)}'
  groupFieldsLists = {'ci': ['groupKey', 'name']}
  entityList = query = showOwnedBy = None
@@ -37389,7 +37498,7 @@ def doShowCIGroupMembers():
      showOwnedBy = convertUIDtoEmailAddress(getEmailAddress(), emailTypes=['user'])
    elif myarg in {'cimember', 'enterprisemember', 'ciowner'}:
      emailAddress = convertUIDtoEmailAddress(getEmailAddress(), emailTypes=['user', 'group'])
-      query = f"member_key_id == '{emailAddress}' && CIGROUP_DISCUSSION_FORUM_LABEL in labels"
+      query = f"member_key_id == '{emailAddress}' && '{CIGROUP_DISCUSSION_FORUM_LABEL}' in labels parent == '{parent}'"
      entityList = None
      if myarg == 'ciowner':
        showOwnedBy = emailAddress
@@ -44318,7 +44427,7 @@ def updateUsers(entityList):
          try:
            result = callGAPI(cd.users(), 'update',
                              throwReasons=[GAPI.CONDITION_NOT_MET, GAPI.USER_NOT_FOUND, GAPI.DOMAIN_NOT_FOUND,
-                                            GAPI.FORBIDDEN, GAPI.BAD_REQUEST,
+                                            GAPI.FORBIDDEN, GAPI.BAD_REQUEST, GAPI.ADMIN_CANNOT_UNSUSPEND,
                                            GAPI.INVALID, GAPI.INVALID_INPUT, GAPI.INVALID_PARAMETER,
                                            GAPI.INVALID_ORGUNIT, GAPI.INVALID_SCHEMA_VALUE, GAPI.DUPLICATE,
                                            GAPI.INSUFFICIENT_ARCHIVED_USER_LICENSES, GAPI.CONFLICT],
@@ -44380,7 +44489,8 @@ def updateUsers(entityList):
      entityActionFailedWarning([Ent.USER, user, Ent.USER, body['primaryEmail']], str(e), i, count)
    except GAPI.invalidOrgunit:
      entityActionFailedWarning([Ent.USER, user], Msg.INVALID_ORGUNIT, i, count)
-    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden, GAPI.badRequest,
+    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis,
+            GAPI.forbidden, GAPI.badRequest, GAPI.adminCannotUnsuspend,
            GAPI.invalid, GAPI.invalidInput, GAPI.invalidParameter, GAPI.insufficientArchivedUserLicenses,
            GAPI.conflict, GAPI.badRequest, GAPI.backendError, GAPI.systemError, GAPI.conditionNotMet) as e:
      entityActionFailedWarning([Ent.USER, user], str(e), i, count)
@@ -44548,12 +44658,14 @@ def suspendUnsuspendUsers(entityList):
    try:
      callGAPI(cd.users(), 'update',
               throwReasons=[GAPI.USER_NOT_FOUND, GAPI.DOMAIN_NOT_FOUND,
-                             GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.FORBIDDEN, GAPI.BAD_REQUEST],
+                             GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.FORBIDDEN, GAPI.BAD_REQUEST,
+                             GAPI.ADMIN_CANNOT_UNSUSPEND],
               userKey=user, body=body)
      entityActionPerformed([Ent.USER, user], i, count)
    except GAPI.userNotFound:
      entityUnknownWarning(Ent.USER, user, i, count)
-    except (GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden, GAPI.badRequest) as e:
+    except (GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden,
+            GAPI.badRequest, GAPI.adminCannotUnsuspend) as e:
      entityActionFailedWarning([Ent.USER, user], str(e), i, count)

 # gam suspend users <UserTypeEntity> [noactionifalias]
@@ -44937,6 +45049,7 @@ def infoUsers(entityList):

  cd = buildGAPIObject(API.DIRECTORY)
  ci = None
+  setTrueCustomerId()
  getAliases = getBuildingNames = getCIGroupsTree = getGroups = getLicenses = getSchemas = not GC.Values[GC.QUICK_INFO_USER]
  getGroupsTree = False
  FJQC = FormatJSONQuoteChar()
@@ -49438,7 +49551,7 @@ def doCourseAddItems(courseIdList, getEntityListArg):
      addItems = getStringReturnInList(Cmd.OB_COURSE_ALIAS)
    elif addType == Ent.COURSE_TOPIC:
      addItems = getStringReturnInList(Cmd.OB_COURSE_TOPIC)
-    else: # addType == Ent.COURSE_ANNOUNCEMENT:
+    else: #elif addType == Ent.COURSE_ANNOUNCEMENT:
      addItems = [getCourseAnnouncement(True)]
    courseParticipantLists = None
  else:
@@ -73375,11 +73488,11 @@ def printShowForms(users):
 FORM_RESPONSE_TIME_OBJECTS = {'createTime', 'lastSubmittedTime'}

 # gam <UserTypeEntity> print formresponses <DriveFileEntity> [todrive <ToDriveAttribute>*]
-#	[filtertime.* <Time>] [filter <String>]
+#	[filter <String> (filtertime<String> <Time>)*]
 #	(addcsvdata <FieldName> <String>)*
 #	[countsonly|(formatjson [quotechar <Character>])]
 # gam <UserTypeEntity> show formresponses <DriveFileEntity>
-#	[filtertime.* <Time>] [filter <String>]
+#	[filter <String> (filtertime<String> <Time>)*]
 #	[countsonly|formatjson]
 def printShowFormResponses(users):
  csvPF = CSVPrintFile(['User', 'formId', 'responseId', 'createTime', 'lastSubmittedTime', 'respondentEmail', 'totalScore'],
@@ -73405,7 +73518,7 @@ def printShowFormResponses(users):
      addCSVData[k] = getString(Cmd.OB_STRING, minLen=0)
    else:
      FJQC.GetFormatJSONQuoteChar(myarg, True)
-  if filterTimes and filter is not None:
+  if filterTimes and frfilter is not None:
    for filterTimeName, filterTimeValue in iter(filterTimes.items()):
      frfilter = frfilter.replace(f'#{filterTimeName}#', filterTimeValue)
  if csvPF:
@@ -76388,6 +76501,147 @@ def importTasklist(users):
                          tasklist=tasklistId, parent=parent, body=task)
        parentIdMap[taskId] = result['id']

+TAGMANAGER_PARAMETERS = {
+  Ent.TAGMANAGER_ACCOUNT: {'api': API.TAGMANAGER, 'respType': 'account', 'parentEntityType': None,
+                           'name': 'name', 'idList': ['accountId']},
+  Ent.TAGMANAGER_CONTAINER: {'api': API.TAGMANAGER, 'respType': 'container', 'parentEntityType': Ent.TAGMANAGER_ACCOUNT,
+                             'name': 'name', 'idList': ['accountId', 'containerId']},
+  Ent.TAGMANAGER_WORKSPACE: {'api': API.TAGMANAGER, 'respType': 'workspace', 'parentEntityType': Ent.TAGMANAGER_CONTAINER,
+                             'name': 'name', 'idList': ['accountId', 'containerId', 'workspaceId']},
+  Ent.TAGMANAGER_TAG: {'api': API.TAGMANAGER, 'respType': 'tag', 'parentEntityType': Ent.TAGMANAGER_WORKSPACE,
+                       'name': 'name', 'idList': ['accountId', 'containerId', 'workspaceId', 'tagId']},
+  Ent.TAGMANAGER_PERMISSION: {'api': API.TAGMANAGER_USERS, 'respType': 'userPermission', 'parentEntityType': Ent.TAGMANAGER_ACCOUNT,
+                             'name': 'emailAddress', 'idList': ['accountId']},
+  }
+
+def printShowTagManagerObjects(users, entityType):
+  csvPF = CSVPrintFile(['User']) if Act.csvFormat() else None
+  FJQC = FormatJSONQuoteChar(csvPF)
+  if entityType == Ent.TAGMANAGER_ACCOUNT:
+    kwargs = {'includeGoogleTags': False}
+    parentList = [None]
+  else:
+    kwargs = {'parent': None}
+    if not checkArgumentPresent('select'):
+      parentList = getString(Cmd.OB_TAGMANAGER_PATH_LIST).replace(',', ' ').split()
+    else:
+      parentList = getEntityList(Cmd.OB_TAGMANAGER_PATH_LIST)
+  parameters = TAGMANAGER_PARAMETERS[entityType]
+  if csvPF:
+    csvPF.AddTitles([parameters['name'], 'path'])
+  while Cmd.ArgumentsRemaining():
+    myarg = getArgument()
+    if csvPF and myarg == 'todrive':
+      csvPF.GetTodriveParameters()
+    elif entityType == Ent.TAGMANAGER_ACCOUNT and myarg == 'includegoogletags':
+      kwargs['includeGoogleTags'] = getBoolean()
+    else:
+      FJQC.GetFormatJSONQuoteChar(myarg, True)
+  i, count, users = getEntityArgument(users)
+  for user in users:
+    i += 1
+    user, svc = buildGAPIServiceObject(parameters['api'], user, i, count)
+    if not svc:
+      continue
+    if entityType == Ent.TAGMANAGER_ACCOUNT:
+      svc = svc.accounts()
+    elif entityType == Ent.TAGMANAGER_CONTAINER:
+      svc = svc.accounts().containers()
+    elif entityType == Ent.TAGMANAGER_WORKSPACE:
+      svc = svc.accounts().containers().workspaces()
+    elif entityType == Ent.TAGMANAGER_TAG:
+      svc = svc.accounts().containers().workspaces().tags()
+    else: #elif entityType == Ent.TAGMANAGER_PERMISSION:
+      svc = svc.accounts().user_permissions()
+    jcount = len(parentList)
+    j = 0
+    for parent in parentList:
+      j += 1
+      if entityType == Ent.TAGMANAGER_ACCOUNT:
+        printGettingAllEntityItemsForWhom(entityType, user, i, count)
+      else:
+        kwargs['parent'] = parent
+        qualifier = f' for {Ent.Singular(parameters["parentEntityType"])}: {parent}'
+        printGettingAllEntityItemsForWhom(entityType, user, i, count, qualifier=qualifier)
+      try:
+        results = callGAPIpages(svc, 'list', parameters['respType'],
+                                 pageMessage=getPageMessageForWhom(),
+                                 throwReasons=GAPI.TAGMANAGER_THROW_REASONS,
+                                 **kwargs)
+      except (GAPI.badRequest, GAPI.invalid, GAPI.notFound) as e:
+        entityActionFailedWarning([Ent.USER, user, entityType, kwargs['parent']], str(e), j, jcount)
+        continue
+      kcount = len(results)
+      if not csvPF:
+        if not  FJQC.formatJSON:
+          entityPerformActionNumItems([Ent.USER, user], kcount, entityType, j, jcount)
+        Ind.Increment()
+        k = 0
+        for result in results:
+          k += 1
+          if not  FJQC.formatJSON:
+            printEntity([entityType, result['path']], k, kcount)
+            Ind.Increment()
+            printKeyValueList([parameters['name'], result.pop(parameters['name'])])
+            for tmid in parameters['idList']:
+              printKeyValueList([tmid, result.pop(tmid)])
+            showJSON(None, result)
+            Ind.Decrement()
+          else:
+            printLine(json.dumps(cleanJSON(result), ensure_ascii=False, sort_keys=True))
+        Ind.Decrement()
+      else:
+        for result in results:
+          baseRow = {'User': user}
+          for tmid in parameters['idList']:
+            baseRow[tmid] = result.pop(tmid)
+          row = flattenJSON(result, flattened=baseRow)
+          if not FJQC.formatJSON:
+            csvPF.WriteRowTitles(row)
+          elif csvPF.CheckRowTitles(row):
+            row = {'User': user, parameters['name']: result[parameters['name']], 'path': result['path']}
+            row['JSON'] = json.dumps(cleanJSON(result), ensure_ascii=False, sort_keys=True)
+            csvPF.WriteRowNoFilter(row)
+  if csvPF:
+    csvPF.writeCSVfile(Ent.Plural(entityType))
+
+# gam <UserTypeEntity> show tagmanageraccounts
+#	[includegoogletags [<Boolean>]]
+#	[formatjson]
+# gam <UserTypeEntity> print tagmanagerccounts [todrive <ToDriveAttribute>*]
+#	[includegoogletags [<Boolean>]]
+#	[formatjson [quotechar <Character>]]
+def printShowTagManagerAccounts(users):
+  printShowTagManagerObjects(users, Ent.TAGMANAGER_ACCOUNT)
+
+# gam <UserTypeEntity> show tagmanagercontainers <TagManagerAccountPathEntity>
+#	[formatjson]
+# gam <UserTypeEntity> print tagmanagercontainers <TagManagerAccountPathEntity> [todrive <ToDriveAttribute>*]
+#	[formatjson [quotechar <Character>]]
+def printShowTagManagerContainers(users):
+  printShowTagManagerObjects(users, Ent.TAGMANAGER_CONTAINER)
+
+# gam <UserTypeEntity> show tagmanagerworkspaces <TagManagerContainerPathEntity>
+#	[formatjson]
+# gam <UserTypeEntity> print tagmanagerworkspaces <TagManagerContainerPathEntity>
+#	[formatjson [quotechar <Character>]]
+def printShowTagManagerWorkspaces(users):
+  printShowTagManagerObjects(users, Ent.TAGMANAGER_WORKSPACE)
+
+# gam <UserTypeEntity> show tagmanagertags <TagManagerWorkspacePathEntity>
+#	[formatjson]
+# gam <UserTypeEntity> print tagmanagertags <TagManagerWorkspacePathEntity> [todrive <ToDriveAttribute>*]
+#	[formatjson [quotechar <Character>]]
+def printShowTagManagerTags(users):
+  printShowTagManagerObjects(users, Ent.TAGMANAGER_TAG)
+
+# gam <UserTypeEntity> show tagmanagerpermissions <TagManagerAccountPathEntity>
+#	[formatjson]
+# gam <UserTypeEntity> print tagmanagerpermissions <TagManagerAccountPathEntity> [todrive <ToDriveAttribute>*]
+#	[formatjson [quotechar <Character>]]
+def printShowTagManagerPermissions(users):
+  printShowTagManagerObjects(users, Ent.TAGMANAGER_PERMISSION)
+
 def getCRMOrgId():
  setTrueCustomerId()
  _, crm = buildGAPIServiceObject(API.CLOUDRESOURCEMANAGER, None)
@@ -78116,6 +78370,11 @@ USER_COMMANDS_WITH_OBJECTS = {
      Cmd.ARG_SITE:		deprecatedUserSites,
      Cmd.ARG_SITEACL:		deprecatedUserSites,
      Cmd.ARG_SITEACTIVITY:	deprecatedUserSites,
+      Cmd.ARG_TAGMANAGERACCOUNT:	printShowTagManagerAccounts,
+      Cmd.ARG_TAGMANAGERCONTAINER:	printShowTagManagerContainers,
+      Cmd.ARG_TAGMANAGERPERMISSION:	printShowTagManagerPermissions,
+      Cmd.ARG_TAGMANAGERTAG:	printShowTagManagerTags,
+      Cmd.ARG_TAGMANAGERWORKSPACE:	printShowTagManagerWorkspaces,
      Cmd.ARG_TASK:		printShowTasks,
      Cmd.ARG_TASKLIST:		printShowTasklists,
      Cmd.ARG_THREAD:		printShowThreads,
@@ -78223,6 +78482,11 @@ USER_COMMANDS_WITH_OBJECTS = {
      Cmd.ARG_SITE:		deprecatedUserSites,
      Cmd.ARG_SITEACL:		deprecatedUserSites,
      Cmd.ARG_SMIME:		printShowSmimes,
+      Cmd.ARG_TAGMANAGERACCOUNT:	printShowTagManagerAccounts,
+      Cmd.ARG_TAGMANAGERCONTAINER:	printShowTagManagerContainers,
+      Cmd.ARG_TAGMANAGERPERMISSION:	printShowTagManagerPermissions,
+      Cmd.ARG_TAGMANAGERTAG:	printShowTagManagerTags,
+      Cmd.ARG_TAGMANAGERWORKSPACE:	printShowTagManagerWorkspaces,
      Cmd.ARG_TASK:		printShowTasks,
      Cmd.ARG_TASKLIST:		printShowTasklists,
      Cmd.ARG_THREAD:		printShowThreads,
@@ -78462,6 +78726,11 @@ USER_COMMANDS_OBJ_ALIASES = {
  Cmd.ARG_SITES:		Cmd.ARG_SITE,
  Cmd.ARG_SITEACLS:		Cmd.ARG_SITEACL,
  Cmd.ARG_SMIMES:		Cmd.ARG_SMIME,
+  Cmd.ARG_TAGMANAGERACCOUNTS:	Cmd.ARG_TAGMANAGERACCOUNT,
+  Cmd.ARG_TAGMANAGERCONTAINERS:	Cmd.ARG_TAGMANAGERCONTAINER,
+  Cmd.ARG_TAGMANAGERPERMISSIONS:	Cmd.ARG_TAGMANAGERPERMISSION,
+  Cmd.ARG_TAGMANAGERTAGS:	Cmd.ARG_TAGMANAGERTAG,
+  Cmd.ARG_TAGMANAGERWORKSPACES:	Cmd.ARG_TAGMANAGERWORKSPACE,
  Cmd.ARG_TASKS:		Cmd.ARG_TASK,
  Cmd.ARG_TASKLISTS:		Cmd.ARG_TASKLIST,
  Cmd.ARG_TEAMDRIVE:		Cmd.ARG_SHAREDDRIVE,
--- a/src/gam/gamlib/glapi.py
+++ b/src/gam/gamlib/glapi.py
@@ -94,6 +94,8 @@ SITEVERIFICATION = 'siteVerification'
 STORAGE = 'storage'
 STORAGEREAD = 'storageread'
 STORAGEWRITE = 'storagewrite'
+TAGMANAGER = 'tagmanager'
+TAGMANAGER_USERS = 'tagmanagerusers'
 TASKS = 'tasks'
 VAULT = 'vault'
 YOUTUBE = 'youtube'
@@ -199,6 +201,7 @@ PROJECT_APIS = [
  'sheets.googleapis.com',
  'siteverification.googleapis.com',
  'storage-api.googleapis.com',
+  'tagmanager.googleapis.com',
  'tasks.googleapis.com',
  'vault.googleapis.com',
  'youtube.googleapis.com',
@@ -277,6 +280,8 @@ _INFO = {
  STORAGE: {'name': 'Cloud Storage API', 'version': 'v1', 'v2discovery': True},
  STORAGEREAD: {'name': 'Cloud Storage API - Read', 'version': 'v1', 'v2discovery': True, 'mappedAPI': STORAGE},
  STORAGEWRITE: {'name': 'Cloud Storage API - Write', 'version': 'v1', 'v2discovery': True, 'mappedAPI': STORAGE},
+  TAGMANAGER: {'name': 'Tag Manager API - Accounts, Containers, Workspaces, Tags', 'version': 'v2', 'v2discovery': True},
+  TAGMANAGER_USERS: {'name': 'Tag Manager API - Users', 'version': 'v2', 'v2discovery': True, 'mappedAPI': TAGMANAGER},
  TASKS: {'name': 'Tasks API', 'version': 'v1', 'v2discovery': True},
  VAULT: {'name': 'Vault API', 'version': 'v1', 'v2discovery': True},
  YOUTUBE: {'name': 'Youtube API', 'version': 'v3', 'v2discovery': True},
@@ -696,6 +701,16 @@ _SVCACCT_SCOPES = [
   'api': SHEETS,
   'subscopes': READONLY,
   'scope': 'https://www.googleapis.com/auth/spreadsheets'},
+  {'name': 'Tag Manager API - Accounts, Containers, Workspaces, Tags - read only',
+   'api': TAGMANAGER,
+   'subscopes': [],
+   'offByDefault': True,
+   'scope': 'https://www.googleapis.com/auth/tagmanager.readonly'},
+  {'name': 'Tag Manager API - Users',
+   'api': TAGMANAGER_USERS,
+   'subscopes': [],
+   'offByDefault': True,
+   'scope': 'https://www.googleapis.com/auth/tagmanager.manage.users'},
  {'name': 'Tasks API',
   'api': TASKS,
   'subscopes': READONLY,
--- a/src/gam/gamlib/glclargs.py
+++ b/src/gam/gamlib/glclargs.py
@@ -782,6 +782,16 @@ class GamCLArgs():
  ARG_SUSPENDED = 'suspended'
  ARG_SVCACCT = 'svcacct'
  ARG_SVCACCTS = 'svcaccts'
+  ARG_TAGMANAGERACCOUNT = 'tagmanageraccount'
+  ARG_TAGMANAGERACCOUNTS = 'tagmanageraccounts'
+  ARG_TAGMANAGERCONTAINER = 'tagmanagercontainer'
+  ARG_TAGMANAGERCONTAINERS = 'tagmanagercontainers'
+  ARG_TAGMANAGERPERMISSION = 'tagmanagerpermission'
+  ARG_TAGMANAGERPERMISSIONS = 'tagmanagerpermissions'
+  ARG_TAGMANAGERTAG = 'tagmanagertag'
+  ARG_TAGMANAGERTAGS = 'tagmanagertags'
+  ARG_TAGMANAGERWORKSPACE = 'tagmanagerworkspace'
+  ARG_TAGMANAGERWORKSPACES = 'tagmanagerworkspaces'
  ARG_TASK = 'task'
  ARG_TASKS = 'tasks'
  ARG_TASKLIST = 'tasklist'
@@ -857,7 +867,10 @@ class GamCLArgs():
  OB_CHAT_SPACE = 'ChatSpace'
  OB_CHAT_SPACE_LIST = 'ChatSpaceList'
  OB_CHAT_THREAD = 'ChatThread'
-  OB_CHROMEPROFILE_ID = 'ChromeProfileId'
+  OB_CHROMEPROFILE_NAME = 'ChromeProfileName'
+  OB_CHROMEPROFILE_NAME_LIST = 'ChromeProfileNameList'
+  OB_CHROMEPROFILE_COMMAND_NAME = 'ChromeProfileCommandName'
+  OB_CHROMEPROFILE_COMMAND_NAME_LIST = 'ChromeProfileNameCommandList'
  OB_CHROME_VERSION = 'ChromeVersion'
  OB_CIDR_NETMASK = 'CIDRnetmask'
  OB_CIGROUP_ALIAS_LIST = "CIGroupAliasList"
@@ -1036,6 +1049,7 @@ class GamCLArgs():
  OB_STRING_LIST = 'StringList'
  OB_STUDENT_ITEM = 'StudentItem'
  OB_TAG = 'Tag'
+  OB_TAGMANAGER_PATH_LIST = 'TagManagerPathList'
  OB_TASK_ID = 'TaskID'
  OB_TASKLIST_ID = 'TaskListID'
  OB_TASKLIST_ID_ENTITY = 'TaskListIDEntity'
--- a/src/gam/gamlib/glentity.py
+++ b/src/gam/gamlib/glentity.py
@@ -358,7 +358,12 @@ class GamEntity():
  SUBSCRIPTION = 'subs'
  SVCACCT = 'svac'
  SVCACCT_KEY = 'svky'
-  TARGET_USER = 'tgt'
+  TAGMANAGER_ACCOUNT = 'tmac'
+  TAGMANAGER_CONTAINER = 'tmco'
+  TAGMANAGER_PERMISSION = 'tmpm'
+  TAGMANAGER_TAG = 'tmtg'
+  TAGMANAGER_WORKSPACE = 'tmws'
+  TARGET_USER = 'tgt '
  TASK = 'task'
  TASKLIST = 'tali'
  TEACHER = 'teac'
@@ -710,6 +715,11 @@ class GamEntity():
    SUBSCRIPTION: ['Subscriptions', 'Subscription'],
    SVCACCT: ['Service Accounts', 'Service Account'],
    SVCACCT_KEY: ['Service Account Keys', 'Service Account Key'],
+    TAGMANAGER_ACCOUNT: ['Tag Manager Accounts', 'Tag Manager Account'],
+    TAGMANAGER_CONTAINER: ['Tag Manager Containers', 'Tag Manager Container'],
+    TAGMANAGER_PERMISSION: ['Tag Manager Permissions', 'Tag Manager Permission'],
+    TAGMANAGER_TAG: ['Tag Manager Tags', 'Tag Manager Tag'],
+    TAGMANAGER_WORKSPACE: ['Tag Manager Workspaces', 'Tag Manager Workspace'],
    TARGET_USER: ['Target Users', 'Target User'],
    TASK: ['Tasks', 'Task'],
    TASKLIST: ['Tasklists', 'Tasklist'],
--- a/src/gam/gamlib/glgapi.py
+++ b/src/gam/gamlib/glgapi.py
@@ -23,6 +23,7 @@
 ABORTED = 'aborted'
 ABUSIVE_CONTENT_RESTRICTION = 'abusiveContentRestriction'
 ACCESS_NOT_CONFIGURED = 'accessNotConfigured'
+ADMIN_CANNOT_UNSUSPEND = 'adminCannotUnsuspend'
 ALREADY_EXISTS = 'alreadyExists'
 APPLY_LABEL_FORBIDDEN = 'applyLabelForbidden'
 AUTH_ERROR = 'authError'
@@ -287,6 +288,7 @@ PEOPLE_ACCESS_THROW_REASONS = [SERVICE_NOT_AVAILABLE, FORBIDDEN, PERMISSION_DENI
 RESELLER_THROW_REASONS = [BAD_REQUEST, RESOURCE_NOT_FOUND, FORBIDDEN, INVALID]
 SHEETS_ACCESS_THROW_REASONS = DRIVE_USER_THROW_REASONS+[NOT_FOUND, PERMISSION_DENIED, FORBIDDEN, INTERNAL_ERROR, INSUFFICIENT_FILE_PERMISSIONS,
                                                        BAD_REQUEST, INVALID, INVALID_ARGUMENT, FAILED_PRECONDITION]
+TAGMANAGER_THROW_REASONS = [BAD_REQUEST, PERMISSION_DENIED, INVALID, NOT_FOUND, ACCESS_NOT_CONFIGURED]
 TASK_THROW_REASONS = [BAD_REQUEST, PERMISSION_DENIED, INVALID, NOT_FOUND, ACCESS_NOT_CONFIGURED]
 TASKLIST_THROW_REASONS = [BAD_REQUEST, PERMISSION_DENIED, INVALID, NOT_FOUND, ACCESS_NOT_CONFIGURED]
 USER_GET_THROW_REASONS = [USER_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, SYSTEM_ERROR]
@@ -367,6 +369,8 @@ class abusiveContentRestriction(Exception):
  pass
 class accessNotConfigured(Exception):
  pass
+class adminCannotUnsuspend(Exception):
+  pass
 class alreadyExists(Exception):
  pass
 class applyLabelForbidden(Exception):
@@ -688,6 +692,7 @@ REASON_EXCEPTION_MAP = {
  ABORTED: aborted,
  ABUSIVE_CONTENT_RESTRICTION: abusiveContentRestriction,
  ACCESS_NOT_CONFIGURED: accessNotConfigured,
+  ADMIN_CANNOT_UNSUSPEND: adminCannotUnsuspend,
  ALREADY_EXISTS: alreadyExists,
  APPLY_LABEL_FORBIDDEN: applyLabelForbidden,
  AUTH_ERROR: authError,
--- a/src/requirements.txt
+++ b/src/requirements.txt
@@ -1,14 +0,0 @@
-chardet>=5.2.0
-cryptography>=44.0.2
-distro; sys_platform=='linux'
-filelock>=3.18.0
-google-api-python-client>=2.167.0
-google-auth-httplib2>=0.2.0
-google-auth-oauthlib>=1.2.2
-google-auth>=2.39.0
-httplib2>=0.22.0
-lxml>=5.4.0
-passlib>=1.7.4
-pathvalidate>=3.2.3
-python-dateutil
-yubikey-manager>=5.6.1
--- a/src/setup.cfg
+++ b/src/setup.cfg
@@ -1,56 +0,0 @@
-[metadata]
-name = GAM for Google Workspace
-#version = attr: gam.var.GAM_VERSION
-version = 7.12.02
-description = Command line management for Google Workspaces
-long_description = file: readme.md
-long_description_content_type = text/markdown
-url = https://github.com/GAM-team/GAM
-author = GAM Team 
-author_email = google-apps-manager@googlegroups.com
-license = Apache
-license_files = LICENSE
-keywords = google, oauth2, gsuite, google-apps, google-admin-sdk, google-drive, google-cloud, google-calendar, gam, google-api, oauth2-client, google-workspace
-classifiers =
-    Programming Language :: Python :: 3
-    Programming Language :: Python :: 3 :: Only
-    Programming Language :: Python :: 3.9
-    Programming Language :: Python :: 3.10
-    Programming Language :: Python :: 3.11
-    Programming Language :: Python :: 3.12
-    Programming Language :: Python :: 3.13
-    License :: OSI Approved :: Apache License
-
-[options]
-packages = find:
-python_requires = >= 3.9
-# The following files should be edited to match: pyproject.toml, requirements.txt
-install_requires =
-    chardet >= 5.2.0
-    cryptography >= 44.0.2
-    distro; sys_platform == 'linux'
-    filelock >= 3.18.0
-    google-api-python-client >= 2.167.0
-    google-auth-httplib2 >= 0.2.0
-    google-auth-oauthlib >= 1.2.2
-    google-auth >= 2.39.0
-    httplib2 >= 0.22.0
-    lxml >= 5.4.0
-    passlib >= 1.7.4
-    pathvalidate >= 3.2.3
-    python-dateutil
-    yubikey-manager >= 5.6.1
-
-[options.package_data]
-* = *.pem
-
-# used during pip install .[test]
-[options.extras_require]
-test = pre-commit
-
-[options.entry_points]
-console_scripts =
-    gam = gam.__main__:main
-
-[bdist_wheel]
-universal = True
--- a/src/setup.py
+++ b/src/setup.py
@@ -1,3 +0,0 @@
-from setuptools import setup
-
-setup()
--- a/wiki/Basic-Items.md
+++ b/wiki/Basic-Items.md
@@ -284,6 +284,9 @@
 <ChatMessage> ::= spaces/<String>/messages/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
+<ChromeProfilePermanentID> ::= <String>
+<ChromeProfileName> ::= customers/<CustomerID>/profiles/<ChromeProfilePermanentID> | <ChromeProfilePermanentID>
+<ChromeProfileCommandName> ::= <ChomeProfileName>/commands/<String>
 <GIGroupAlias> ::= <EmailAddress>
 <GIGroupItem> ::= <EmailAddress>|<UniqueID>|groups/<String>
 <CIGroupMemberType> ::= cbcmbrowser|chromeosdevice|customer|group|other|serviceaccount|user
@@ -516,6 +519,14 @@
        gs://<StorageBucketName>/<StorageObjectName>|
        <StorageBucketName>/<StorageObjectName>
 <Tag> ::= <String>
+<TagManagerAccountID> ::= <String>
+<TagManagerAccountPath> ::= accounts/<TagManagerAccountID>
+<TagManagerContainerID> ::= <String>
+<TagManagerContainerPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>
+<TagManagerWorkspaceID> ::= <String>
+<TagManagerWorkspacePath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>
+<TagManagerTagID> ::= <String>
+<TagManagerTagPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>/tags/<TagManagerTagID>
 <TakeoutBucketName> ::= takeout-export-[a-f,0-9,-]*
 <TaskID> ::= <String>
 <TaskListID> ::= <String>
--- a/wiki/Chat-Bot.md
+++ b/wiki/Chat-Bot.md
@@ -40,6 +40,7 @@ GAM is capable of acting as a Chat Bot and sending messages to Chat Rooms or dir
 Even if you're not going to use GAM as a Chat Bot, you have to configure a Chat Bot as it is required by the Chat API in [Users - Chat](Users-Chat).

 * Run the command `gam setup chat`; it will point you to a URL to configure your Chat Bot.
+* Uncheck "Build this Chat app as a Workspace add-on."
 * Enter an App name and Description of your choosing.
 * For the Avatar URL you can use `https://dummyimage.com/384x256/4d4d4d/0011ff.png&text=+GAM` or a public URL to an image of your own choosing.
 * In Functionality, uncheck both "Receive 1:1 messages" and "Join spaces and group conversations"
--- a/wiki/Chrome-Profile-Management.md
+++ b/wiki/Chrome-Profile-Management.md
@@ -5,6 +5,7 @@
 - [Delete Chrome Profiles](#delete-chrome-profiles)
 - [Display Chrome Profiles](#display-chrome-profiles)
 - [Profile Query Searchable Fields](#profile-query-searchable-fields)
+- [Collections of Chrome Profile names for commands](#collections-of-chrome-profile-names-for-commands)
 - [Create a Chrome Profile command](#create-a-chrome-profile-command)
 - [Display Chrome Profile commands](#display-chrome-profile-commands)

@@ -27,11 +28,20 @@ Follow instructions at: Turn on managed profile reporting
 * [Turn on Chrome Browser and Profile Reporting](https://support.google.com/chrome/a/answer/9301421)

 ## Definitions
+* [`<FileSelector> | <CSVFileSelector>`](Collections-of-Items)
+
 ```
 <CustomerID> ::= <String>
 <ChromeProfilePermanentID> ::= <String>
 <ChromeProfileName> ::= customers/<CustomerID>/profiles/<ChromeProfilePermanentID> | <ChromeProfilePermanentID>
+<ChromeProfileNameList> ::= "<ChromeProfileName>(,<ChromeProfileName>)*"
 <ChromeProfileCommandName> ::= <ChomeProfileName>/commands/<String>
+<ChromeProfileCommandNameList> ::= "<ChromeProfileCommandName>(,<ChromeProfileCommandName>)*"
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]) |
+        (commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>)

 <ChromeProfileFieldName> ::=
        affiliationstate|
@@ -97,7 +107,7 @@ By default, Gam displays the information as an indented list of keys and values:

 ```
 gam show chromeprofiles
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]
        <ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
        [formatjson]
@@ -110,7 +120,7 @@ Select the fields to be displayed:
 * `<ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]` - Display a selected list of fields

 Use the `filtertime<String> <Time>` option to allow times, usually relative, to be substituted into the `filter <String>` option.
-The `filtertime<String> <Time>` value replaces the string `#fiktertime<String>#` in the `filter <String>`.
+The `filtertime<String> <Time>` value replaces the string `#filtertime<String>#` in the `filter <String>`.
 The characters following `filtertime` can be any combination of lowercase letters and numbers.

 By default, Gam displays the information as an indented list of keys and values:
@@ -118,7 +128,7 @@ By default, Gam displays the information as an indented list of keys and values:

 ```
 gam print chromeprofiles [todrive <ToDriveAttribute>*]
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]
        <ChromeProfileFieldName>* [fields <ChromeProfileFieldNameList>]
        [formatjson [quotechar <Character>]]
@@ -197,14 +207,38 @@ Print information about Chrome profiles on Windows.
 ```
 gam print chromeprofiles filter "osPlatformType=WINDOWS"
 ```
+## Collections of Chrome Profile names for commands
+```
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <ChromeProfileNameList>|<FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]) |
+        (commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>)
+```
+* `<ChromeProfileNameList>` - A list of Chrome profile names
+* `select <ChromeProfileNameList>` - A list of Chrome profile names
+* `select <FileSelector>|<CSVFileSelector>` - A flat or CSV file containing Chrome profile names
+* `filter <String> (filtertime<String> <Time>)*` - A filter to select Chrome profiles
+* `commands  <ChromeProfileCommandNameList>` - A list of  Chrome profile command names
+* `commands  <FileSelector>|<CSVFileSelector>` - A flat or CSV file containing Chrome profile command names
+
+Use the `filtertime<String> <Time>` option to allow times, usually relative, to be substituted into the `filter <String>` option.
+The `filtertime<String> <Time>` value replaces the string `#filtertime<String>#` in the `filter <String>`.
+The characters following `filtertime` can be any combination of lowercase letters and numbers.

 ## Create a Chrome Profile command
+Clear a Chrome Browser profile cache and/or cookies.
 ```
-gam create chromeprofilecommand <ChromeProfileName>
+gam create chromeprofilecommand <ChromeProfileNameEntity>
        [clearcache [<Boolean>]] [clearcookies [<Boolean>]]
-        [formatjson]
+        [csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]
 ```
+By default, when a Chrome profile command is created, GAM outputs details of the command as indented keywords and values.
+* `formatjson` - Display the details in JSON format.
+* `csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]` - Output the details in CSV format.
+
 ## Display Chrome Profile commands
+Display the status of a specific Chrome Browser profile command.
 ```
 gam info chromeprofilecommand <ChromeProfileCommandName>
        [formatjson]
@@ -212,15 +246,16 @@ gam info chromeprofilecommand <ChromeProfileCommandName>
 By default, Gam displays the information as an indented list of keys and values:
 * `formatjson` - Display the fields in JSON format.

+Display the status of selected Chrome Browser profile commands.
 ```
-gam show chromeprofilecommands <ChromeProfileName>
+gam show chromeprofilecommands <ChromeProfileNameEntity>
        [formatjson]
 ```

 By default, Gam displays the information as an indented list of keys and values:
 * `formatjson` - Display the fields in JSON format.
 ```
-gam print chromeprofilecommands <ChromeProfileName> [todrive <ToDriveAttribute>*]
+gam print chromeprofilecommands <ChromeProfileNameEntity> [todrive <ToDriveAttribute>*]
        [formatjson [quotechar <Character>]]
 ```
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
@@ -232,3 +267,50 @@ When using the `formatjson` option, double quotes are used extensively in the da
 The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
 `quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.

+### Examples
+
+For Windows PowerShell, replace `\"` with ``` `" ```.
+
+Clear cache and cookies for two specific Chrome profiles:
+```
+gam create chromeprofilecommand 4c6c0a9f-de78-4285-be86-713fca8cffff,aa03151c-7c1d-41fe-b793-5753e167ffff clearcache clearcookies
+```
+
+Display the command status for those Chrome profiles:
+```
+gam show chromeprofilecommand 4c6c0a9f-de78-4285-be86-713fca8cffff,aa03151c-7c1d-41fe-b793-5753e167ffff
+gam print chromeprofilecommand 4c6c0a9f-de78-4285-be86-713fca8cffff,aa03151c-7c1d-41fe-b793-5753e167ffff
+```
+
+Clear cache and cookies for Chrome profiles in a CSV file named `ChromeProfiles.csv` with a column `name`:
+```
+gam create chromeprofilecommand select csvfile ChromeProfiles.csv:name clearcache clearcookies
+```
+
+Display the command status for those Chrome profiles:
+```
+gam show chromeprofilecommand select csvfile ChromeProfiles.csv:name
+gam print chromeprofilecommand select csvfile ChromeProfiles.csv:name
+```
+
+Clear cache and cookies for Chrome profiles with last activity more that 60 days ago:
+```
+gam create chromeprofilecommand filter "lastActivityTime < \"#filtertime1#\"" filtertime1 -60d clearcache clearcookies
+```
+
+Display the command status for those Chrome profiles:
+```
+gam show chromeprofilecommand filter "lastActivityTime < \"#filtertime1#\"" filtertime1 -60d
+gam print chromeprofilecommand filter "lastActivityTime < \"#filtertime1#\"" filtertime1 -60d
+```
+
+Clear cache and cookies for Chrome profiles with last activity more that 60 days ago:
+```
+gam redirect csv ./ChromeProfileCmds.csv create chromeprofilecommand filter "lastActivityTime < \"#filtertime1#\"" filtertime1 -60d clearcache clearcookies csv
+```
+
+Display the command status for those Chrome profile commands
+```
+gam show chromeprofilecommand commands ChromeProfileCmds.csv:name
+gam print chromeprofilecommand commands ChromeProfileCmds.csv:name
+```
--- a/wiki/Cloud-Identity-Groups-Membership.md
+++ b/wiki/Cloud-Identity-Groups-Membership.md
@@ -1,6 +1,5 @@
 # Cloud Identity Groups - Membership
 - [API documentation](#api-documentation)
- [Query documentation](#query-documentation)
 - [Python Regular Expressions](Python-Regular-Expressions) Match function
 - [Definitions](#definitions)
 - [Notes](#Notes)
@@ -22,10 +21,6 @@
 * [Cloud Identity Groups](https://gsuiteupdates.googleblog.com/2020/08/new-api-cloud-identity-groups-google.html)
 * [Security Groups](https://gsuiteupdates.googleblog.com/2020/09/security-groups-beta.html)

-## Query documentation
-* [Cloud Identity Groups API - Search Dynamic Groups](https://cloud.google.com/identity/docs/reference/rest/v1/groups#dynamicgroupquery)
-* [Member Restrictions](https://cloud.google.com/identity/docs/reference/rest/v1/SecuritySettings#MemberRestriction)
-
 ## Notes

 In the Admin Directory API a group has the following characteristics:
@@ -45,7 +40,7 @@ Dynamic Groups require Cloud Identity Premium accounts.
 * https://cloud.google.com/identity/docs/how-to/create-dynamic-groups

 The `cimember <UserItem>` option of `gam print|show cigroup-members` requires a Google Workspace Enterprise Standard, Enterprise Plus, and Enterprise for Education;
-and Cloud Identity Premium accounts. Unfortunately, even if you have the required account, the API call that supports the query doesn't work.
+and Cloud Identity Premium accounts.

 * https://cloud.google.com/identity/docs/reference/rest/v1/groups.memberships/searchTransitiveGroups

--- a/wiki/Cloud-Identity-Groups.md
+++ b/wiki/Cloud-Identity-Groups.md
@@ -19,7 +19,8 @@
 * [Security Groups](https://gsuiteupdates.googleblog.com/2020/09/security-groups-beta.html)

 ## Query documentation
-* [Cloud Identity Groups API - Search Dynamic Groups](https://cloud.google.com/identity/docs/reference/rest/v1/groups#dynamicgroupquery)
+* [Cloud Identity Groups API - Search](https://cloud.google.com/identity/docs/reference/rest/v1/groups/search)
+* [Cloud Identity Groups API - Dynamic Group Query](https://cloud.google.com/identity/docs/reference/rest/v1/groups#dynamicgroupquery)
 * [Dynamic Groups Member Attributes](https://cloud.google.com/identity/docs/how-to/dynamic-groups-attributes)
 * [Member Restrictions](https://cloud.google.com/identity/docs/reference/rest/v1/SecuritySettings#MemberRestriction)

@@ -51,7 +52,7 @@ Dynamic Groups require Cloud Identity Premium accounts.
 * https://cloud.google.com/identity/docs/how-to/create-dynamic-groups

 The `cimember <UserItem>` option of `gam print cigroups` requires a Google Workspace Enterprise Standard, Enterprise Plus, and Enterprise for Education;
-and Cloud Identity Premium accounts. Unfortunately, even if you have the required account, the API call that supports the query doesn't work.
+and Cloud Identity Premium accounts.

 * https://cloud.google.com/identity/docs/reference/rest/v1/groups.memberships/searchTransitiveGroups

--- a/wiki/Collections-of-Items.md
+++ b/wiki/Collections-of-Items.md
@@ -144,6 +144,11 @@ Data fields identified in a `csvkmd` argument.
        <CalendarACLScopeList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 <CalendarEntity> ::=
        <CalendarList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]]) |
+        (commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>)
 <CIPolicyNameEntity> ::=
        <CIPolicyNameList> | <FileSelector> | <CSVFileSelector>
 <ClassificationLabelNameEntity> ::=
@@ -206,6 +211,7 @@ Data fields identified in a `csvkmd` argument.
        all_shortcuts |
        all_3p_shortcuts |
        all_items |
+        my_commentable_items |
        my_docs |
        my_files |
        my_folders |
@@ -231,6 +237,7 @@ Data fields identified in a `csvkmd` argument.
        others_3p_shortcuts |
        others_items |
        writable_files
+
 <DriveFileEntityShortcut> ::=
        alldrives |
        mydrive_any |
@@ -246,6 +253,7 @@ Data fields identified in a `csvkmd` argument.
        sharedwithme_all |
        sharedwithme_mydrive |
        sharedwithme_notmydrive
+
 <DriveFileEntity> ::=
        <DriveFileIDEntity> |
        <DriveFileNameEntity> |
@@ -343,6 +351,15 @@ Data fields identified in a `csvkmd` argument.
        <SiteACLScopeList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 <SiteEntity> ::=
        <SiteList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+<TagManagerAccountPathEntity> ::=
+        <TagManagerAccountPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+<TagManagerContainerPathEntity> ::=
+        <TagManagerContainerPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+<TagManagerWorkspacePathEntity> ::=
+        <TagManagerWorkspacePathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
 <TasklistEntity> ::=
        <TasklistIDList> | <TaskListTitleList> | <FileSelector> | <CSVFileSelector>
 <TasklistIDTaskIDEntity> ::=
--- a/wiki/Domain-SharedContacts.md
+++ b/wiki/Domain-SharedContacts.md
@@ -308,12 +308,3 @@ the quote character itself, the column delimiter (comma by default) and new-line
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
 The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
 `quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
-
-## Display global address list
-As of mid-October 2024, Google deprecated the API that retrieved the Global Address List.
-
-These commands are a work-around.
-```
-gam config csv_output_row_filter "includeInGlobalAddressList:boolean:true" redirect csv ./UserGAL.csv print users fields name,gal
-gam config csv_output_row_filter "includeInGlobalAddressList:boolean:true" batch_size 25 redirect csv ./GroupGAL.csv print groups fields name,gal
-```
--- a/wiki/GamUpdates.md
+++ b/wiki/GamUpdates.md
@@ -10,6 +10,70 @@ Add the `-s` option to the end of the above commands to suppress creating the `g

 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation

+### 7.14.03
+
+Fixed bug in `gam print cigroup-members includederivedmembership` that caused a trap.
+
+### 7.14.02
+
+Fixed bug in `gam print|show cigroups|cigroups-members cimember <UserItem>` that generated the following error:
+```
+Cloud Identity Group Print Failed: Request contains an invalid argument.
+```
+
+### 7.14.01
+
+Don't install yubikey library via pip by default. To install with yubikey support use pip install gam7[yubikey]
+
+### 7.14.00
+
+Added commands to display Google Tag Manager accounts, containers, workspaces, tags and user permissions.
+
+* See: https://github.com/GAM-team/GAM/wiki/Users-Tag-Manager
+
+### 7.13.03
+
+Added option `csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]`
+to `gam create chromeprofilecommand` so that command details are displayed in CSV format.
+
+Added option `commands <ChromeProfileCommandNameList>|<FileSelector>|<CSVFileSelector>` to `<ChromeProfileNameEntity>`
+so that `gam print|show chromeprofilecommands` can directly display the commands generated by
+`gam create chromeprofilecommand` with the `csv` option.
+
+### 7.13.02
+
+Fixed bug in `gam create chromeprofilecommand` where `select|filter` were not recognized.
+
+Updated `gam create datatransfer <OldOwnerID> datastudio <NewOwnerID>` that generated the following
+error due to an unhandled API change.
+```
+ERROR: Invalid choice (google data studio): Expected <calendar|looker studio|drive and docs>
+```
+
+### 7.13.01
+
+Enhanced `gam create|print|show chromeprofilecommand` to allow specification
+of multiple Chrome browser profiles rather than just one.
+```
+<ChromeProfilePermanentID> ::= <String>
+<ChromeProfileName> ::= customers/<CustomerID>/profiles/<ChromeProfilePermanentID> | <ChromeProfilePermanentID>
+<ChromeProfileNameList> ::= "<ChromeProfileName>(,<ChromeProfileName>)*"
+<ChromeProfileNameEntity> ::=
+<ChromeProfileNameEntity> ::=
+        <ChromeProfileNameList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+        (filter <String> (filtertime<String> <Time>)* [orderby <ChromeProfileOrderByFieldName> [ascending|descending]])
+
+gam create|print_show chromeprofilecommand <ChromeProfileNameEntity>
+```
+
+### 7.13.00
+
+Added commands that send remote commands to Chrome browser profiles and display the results;
+at the moment, these commands can clear the browser cache and cookies.
+
+* See: https://github.com/GAM-team/GAM/wiki/Chrome-Profile-Management#create-a-chrome-profile-command
+
 ### 7.12.02

 Updated `gam print users` to handle the following error:
--- a/wiki/Global-Address-List.md
+++ b/wiki/Global-Address-List.md
@@ -0,0 +1,17 @@
+# Global Address List
+
+As of mid-October 2024, Google deprecated the API that retrieved the Global Address List.
+
+These commands are a work-around.
+
+Display users/groups in GAL.
+```
+gam config csv_output_row_filter "includeInGlobalAddressList:boolean:true" redirect csv ./UserGAL.csv print users fields name,gal
+gam config csv_output_row_filter "includeInGlobalAddressList:boolean:true" batch_size 25 redirect csv ./GroupGAL.csv print groups fields name,gal
+```
+
+Display users/groups not in GAL.
+```
+gam config csv_output_row_filter "includeInGlobalAddressList:boolean:false" redirect csv ./UserNotGAL.csv print users fields name,gal
+gam config csv_output_row_filter "includeInGlobalAddressList:boolean:false" batch_size 25 redirect csv ./GroupNotGAL.csv print groups fields name,gal
+```
--- a/wiki/Google-Data-Transfers.md
+++ b/wiki/Google-Data-Transfers.md
@@ -13,8 +13,7 @@
 ```
 <DataTransferService> ::=
        calendar|
-        currents|
-        datastudio|lookerstudio|"google data studio"|
+        datastudio|lookerstudio|"looker studio"|
        drive|gdrive|googledrive|"drive and docs"
 <DataTransferServiceList> ::= "<DataTransferService>(,<DataTransferService>)*"

@@ -38,7 +37,7 @@ gam create|add datatransfer|transfer <OldOwnerID> <DataTransferServiceList> <New
        (<ParameterKey> <ParameterValue>)*
        [wait <Integer> <Integer>]
 ```
-For`datastudio` and `drive`, there are options to control the privacy level of the files to be transferred.
+For`lookerstudio` and `drive`, there are options to control the privacy level of the files to be transferred.
 * `private` or `privacy_level private` - Transfer files that are not shared with anyone
 * `shared` or `privacy_level shared` - Transfer files shared with at least one other user; this is the **default**
 * `all` or `privacy_level private,shared` - Transfer all files
--- a/wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md
+++ b/wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md
@@ -251,7 +251,7 @@ writes the credentials into the file oauth2.txt.
 admin@server:/Users/admin$ rm -f /Users/admin/GAMConfig/oauth2.txt
 admin@server:/Users/admin$ gam version
 WARNING: Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /Users/admin/GAMConfig/oauth2.txt, Not Found
-GAM 7.12.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.14.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -989,7 +989,7 @@ writes the credentials into the file oauth2.txt.
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
 WARNING: Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: C:\GAMConfig\oauth2.txt, Not Found
-GAM 7.12.02 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.14.03 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 Windows-10-10.0.17134 AMD64
--- a/wiki/Install-GAM-as-Python-Library.md
+++ b/wiki/Install-GAM-as-Python-Library.md
@@ -1,20 +1,14 @@
 # Install GAM as Python Library

-Thanks to Jay Lee for showing me how to do this.
-
-On Windows, you need to install Git to use the pip command.
-* See: https://pythoninoffice.com/python-pip-install-from-github/
-
-Scroll down to Install Git

 You can install GAM as a Python library with pip.
 ```
-pip install git+https://github.com/GAM-team/GAM.git#subdirectory=src
+pip install gam7
 ```

 Or as a PEP 508 Requirement Specifier, e.g. in requirements.txt file:
 ```
-gam-for-google-workspace @ git+https://github.com/GAM-team/GAM.git#subdirectory=src
+gam7
 ```

 Or a pyproject.toml file:
@@ -23,13 +17,13 @@ Or a pyproject.toml file:
 name = "your-project"
 # ...
 dependencies = [
-    "gam-for-google-workspace @ git+https://github.com/GAM-team/GAM.git#subdirectory=src"
+    "gam7"
 ]
 ```

-Target a specific revision or tag:
+Target a specific version:
 ```
-gam-for-google-workspace @ git+https://github.com/GAM-team/GAM.git@v7.12.01#subdirectory=src
+gam7==/7.13.3
 ```

 ## Using the library
--- a/wiki/List-Items.md
+++ b/wiki/List-Items.md
@@ -11,6 +11,8 @@
 <CalendarACLScopeList> ::= "<CalendarACLScope>(,<CalendarACLScope>)*"
 <CalendarList> ::= "<CalendarItem>(,<CalendarItem>)*"
 <ChatSpaceList> ::= "<ChatSpace>(,<ChatSpace>)*"
+<ChromeProfileNameList> ::= "<ChromeProfileName>(,<ChromeProfileName>)*"
+<ChromeProfileCommandNameList> ::= "<ChromeProfileCommandName>(,<ChromeProfileCommandName>)*"
 <CIGroupAliasList> ::= "<CIGroupAlias>(,<CIGroupAlias>)*"
 <CIGroupMemberTypeList> ::= "<CIGroupMemberType>(,<CIGroupMemberType>)*"
 <CIPolicyNameList> ::= "<CIPolicyName>(,<CIPolicyName>)*"
@@ -96,6 +98,9 @@
 <SharedDriveACLRoleList> ::= "<SharedDriveACLRole>(,<SharedDriveACLRole>)*"
 <SharedDriveIDList> ::= "<SharedDriveID>(,<SharedDriveID>)*"
 <StringList> ::= "<String>(,<String>)*"
+<TagManagerAccountPathList> ::= "<TagManagerAccountPath>(,<TagManagerAccountPath>)*"
+<TagManagerContainerPathList> ::= "<TagManagerContainerPath>(,<TagManagerContainerPath>)*"
+<TagManagerWorkspacePathList> ::= "<TagManagerWorkspacePath>(,<TagManagerWorkspacePath>)*"
 <TasklistIDList> ::= "<TasklistID>(,<TasklistID>)*"
 <TasklistTitleList> ::= "'<TasklistTitle>'(,'<TasklistTitle>')*"
 <TasklistIDTaskIDList> ::= "<TasklistIDTaskID>(,<TasklistIDTaskID>)*"
--- a/wiki/Reports.md
+++ b/wiki/Reports.md
@@ -68,7 +68,7 @@ gam report <ActivityApplicationName> [todrive <ToDriveAttribute>*]
        [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
        [([start <Time>] [end <Time>])|(range <Time> <Time>)|
         yesterday|today|thismonth|(previousmonths <Integer>)]
-        [filtertime<String> <Time>] [filter|filters <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [event|events <EventNameList>] [ip <String>]
        [groupidfilter <String>]
        [maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
@@ -363,7 +363,7 @@ gam report users|user [todrive <ToDriveAttribute>*]
        [(date <Date>)|(range <Date> <Date>)|
         yesterday|today|thismonth|(previousmonths <Integer>)]
        [(nodatechange | limitdatechanges <Integer>) | (fulldatarequired all|<UserServiceNameList>)]
-        [filtertime<String> <Time>] [filter|filters <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [(fields|parameters <String>)|(services <UserServiceNameList>)]
        [aggregatebydate|aggregatebyuser [Boolean]]
        [maxresults <Number>]
@@ -413,7 +413,7 @@ where you can specify a relative date without having to change the script.

 For example, filter for last logins more that 60 days ago.
 ```
-filtertime60d -60d filters "accounts:last_login_time<#filtertime60d#"
+filters "accounts:last_login_time<#filtertime60d#" filtertime60d -60d
 ```

 Select the fields/parameters to display.
--- a/wiki/Shared-Drives.md
+++ b/wiki/Shared-Drives.md
@@ -45,6 +45,8 @@
 * [Shared Drives Search](https://developers.google.com/drive/api/guides/search-shareddrives)

 ## Definitions
+* [`<FileSelector> | <CSVFileSelector>`](Collections-of-Items)
+
 ```
 <ColorHex> ::= "#<Hex><Hex><Hex><Hex><Hex><Hex>"
 <ColorNameGoogle> ::=
--- a/wiki/Users-Drive-Permissions.md
+++ b/wiki/Users-Drive-Permissions.md
@@ -214,6 +214,12 @@ The option `updatesheetprotectedranges` only applies to items in `<DriveFileEnti
    * ACLs with role reader or commenter will be removed from existing protected ranges
    * ACLs with role writer or higher will be added to existing protected ranges

+`
+`enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
+the ability to update inherited ACLs.
+* False - Inherited ACLs can be updated
+* True = Inherited ACLs can not be updated
+
 By default, the file ID is displayed in the output; to see the file name, use the `showtitles`
 option; this requires an additional API call per file.

@@ -234,6 +240,11 @@ The option `updatesheetprotectedranges` only applies to items in `<DriveFileEnti
  * Sheet Protected Ranges are updated to reflect the deleted ACL; additional API calls are required.
    * ACLs with any role will be removed from existing protected ranges

+`enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
+the ability to delete delete inherited ACLs.
+* False - Inherited ACLs can be deleted
+* True = Inherited ACLs can not be deleted
+
 By default, the file ID is displayed in the output; to see the file name, use the `showtitles`
 option; this requires an additional API call per file.

@@ -266,6 +277,11 @@ gam <UserTypeEntity> delete permissions <DriveFileEntity> <DriveFilePermissionID
        <PermissionMatch>* [<PermissionMatchAction>]
        [enforceexpansiveaccess [<Boolean>]]
 ```
+`enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
+the ability to delete delete inherited ACLs.
+* False - Inherited ACLs can be deleted
+* True = Inherited ACLs can not be deleted
+
 When deleting permissions from JSON data, permissions with role `owner` true are never processed.

 ## Display file permissions/sharing
--- a/wiki/Users-Forms.md
+++ b/wiki/Users-Forms.md
@@ -290,7 +290,7 @@ Select forms with `<DriveFileEntity>`:
 * `my_forms` - Display responses for all forms owned by the user
 ```
 gam <UserTypeEntity> show formresponses <DriveFileEntity>
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [countsonly|formatjson]
 ```
 By default, GAM displays form response details, use the `countsonly` option to get the number of responses but no response details.
@@ -302,11 +302,12 @@ By default, GAM displays all form responses, you can filter by response time:
 For example, to get the form responses submitted since the beginning of the year:
 * `filter timestamp >= 2022-01-01T00:00:00Z`

-Use the `filtertime.* <Time>` option to allow times, usually relative, to be substituted into the `filter <String>` option.
+Use the `filtertime<String <Time>` option to allow times, usually relative, to be substituted into the `filter <String>` option.
+The `filtertime<String> <Time>` value replaces the string `#filtertime<String>#` in any filters..
 The characters following `filtertime` can be any combination of lowercase letters and numbers.

-For example, to get the responses subnitted in the last four hours:
-* `filtertime4h -4h filter "timestamp >= #filtertime4h#`
+For example, to get the responses submitted in the last four hours:
+* `filter "timestamp >= #filtertime4h#" filtertime4h -4h`

 By default, Gam displays the information as an indented list of keys and values.
 * `formatjson` - Display the form response in JSON format
@@ -314,7 +315,7 @@ By default, Gam displays the information as an indented list of keys and values.
 ```
 gam <UserTypeEntity> print formresponses <DriveFileEntity> [todrive <ToDriveAttribute>*]
        (addcsvdata <FieldName> <String>)*
-        [filtertime.* <Time>] [filter <String>]
+        [filter <String> (filtertime<String> <Time>)*]
        [countsonly|(formatjson [quotechar <Character>])]
 ```
 By default, GAM displays form response details, use the `countsonly` option to get the number of responses but no response details.
@@ -328,11 +329,12 @@ By default, GAM displays all form responses, you can filter by response time:
 For example, to get the form responses submitted since the beginning of the year:
 * `filter timestamp >= 2022-01-01T00:00:00Z`

-Use the `filtertime.* <Time>` option to allow times, usually relative, to be substituted into the `filter <String>` option.
+Use the `filtertime<String> <Time>` option to allow times, usually relative, to be substituted into the `filter <String>` option.
+The `filtertime<String> <Time>` value replaces the string `#filtertime<String>#` in any filters..
 The characters following `filtertime` can be any combination of lowercase letters and numbers.

 For example, to get the responses subnitted in the last four hours:
-* `filtertime4h -4h filter "timestamp >= #filtertime4h#`
+* `filter "timestamp >= #filtertime4h#" filtertime4h -4h`

 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
--- a/wiki/Users-Tag-Manager.md
+++ b/wiki/Users-Tag-Manager.md
@@ -0,0 +1,213 @@
+# Users - Tag Manager
+- [API documentation](#api-documentation)
+- [Notes](#notes)
+- [Definitions](#definitions)
+- [Display Tag Manager Accounts](#display-tag-manager-accounts)
+- [Display Tag Manager Containers](#display-tag-manager-containers)
+- [Display Tag Manager Workspaces](#display-tag-manager-workspaces)
+- [Display Tag Manager Tags](#display-tag-manager-tags)
+- [Display Tag Manager User Permissions](#display-tag-manager-user-permissions)
+- [Examples](#examples)
+
+## API documentation
+* [Tag Manager API](https://developers.google.com/tag-manager/reference/rest)
+
+## Notes
+To use these commands you must add the 'Tag Manager API' to your project and update your service account authorization.
+```
+gam update project
+gam user user@domain.com update serviceaccount
+
+[*] 41)  Tag Manager API - Accounts, Containers, Workspaces, Tags - read only
+[*] 42)  Tag Manager API - Users
+
+```
+
+## Definitions
+* [`<UserTypeEntity>`](Collections-of-Users)
+* [`<FileSelector> | <CSVFileSelector>`](Collections-of-Items)
+```
+<TagManagerAccountID> ::= <String>
+<TagManagerAccountPath> ::= accounts/<TagManagerAccountID>
+<TagManagerAccountPathList> ::= "<TagManagerAccountPath>(,<TagManagerAccountPath>)*"
+<TagManagerAccountPathEntity> ::=
+        <TagManagerAccountPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+
+<TagManagerContainerID> ::= <String>
+<TagManagerContainerPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>
+<TagManagerContainerPathList> ::= "<TagManagerContainerPath>(,<TagManagerContainerPath>)*"
+<TagManagerContainerPathEntity> ::=
+        <TagManagerContainerPathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+
+<TagManagerWorkspaceID> ::= <String>
+<TagManagerWorkspacePath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>
+<TagManagerWorkspacePathList> ::= "<TagManagerWorkspacePath>(,<TagManagerWorkspacePath>)*"
+<TagManagerWorkspacePathEntity> ::=
+        <TagManagerWorkspacePathList> |
+        (select <FileSelector>|<CSVFileSelector>) |
+
+<TagManagerTagID> ::= <String>
+<TagManagerTagPath> ::= accounts/<TagManagerAccountID>/containers/<TagManagerContainerID>/workspaces/<TagManagerWorkspaceID>/tags/<TagManagerTagID>
+```
+## Display Tag Manager Accounts
+```
+gam <UserTypeEntity> show tagmanageraccounts
+        [includegoogletags [<Boolean>]]
+        [formatjson]
+```
+By default, Gam displays the accounts as an indented list of keys and values.
+* `formatjson` - Display the account in JSON format
+
+```
+gam <UserTypeEntity> print tagmanagerccounts [todrive <ToDriveAttribute>*]
+        [includegoogletags [<Boolean>]]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the accounts as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+## Display Tag Manager Containers
+```
+gam <UserTypeEntity> show tagmanagercontainers <TagManagerAccountPathEntity>
+        [formatjson]
+```
+By default, Gam displays the containers as an indented list of keys and values.
+* `formatjson` - Display the container in JSON format
+
+```
+gam <UserTypeEntity> print tagmanagercontainers <TagManagerAccountPathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the containers as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+## Display Tag Manager Workspaces
+```
+gam <UserTypeEntity> show tagmanagerworkspaces <TagManagerContainerPathEntity>
+        [formatjson]
+```
+By default, Gam displays the workspaces as an indented list of keys and values.
+* `formatjson` - Display the workspace in JSON format
+
+```
+gam <UserTypeEntity> print tagmanagerworkspaces <TagManagerContainerPathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the workspaces as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+## Display Tag Manager Tags
+```
+gam <UserTypeEntity> show tagmanagertags <TagManagerWorkspacePathEntity>
+        [formatjson]
+```
+By default, Gam displays the tags as an indented list of keys and values.
+* `formatjson` - Display the tag in JSON format
+
+```
+gam <UserTypeEntity> print tagmanagertags <TagManagerWorkspacePathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the tags as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+## Display Tag Manager User Permissions
+```
+gam <UserTypeEntity> show tagmanagerpermissions <TagManagerAccountPathEntity>
+        [formatjson]
+```
+By default, Gam displays the permissions as an indented list of keys and values.
+* `formatjson` - Display the permission in JSON format
+
+```
+gam <UserTypeEntity> print tagmanagerpermissions <TagManagerAccountPathEntity> [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the permissions as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+### Examples
+Single user - Get CSV data.
+```
+$ gam redirect csv ./tmaccounts.csv user taguser@domain.com print tagmanageraccounts 
+
+$ gam redirect csv ./tmcontainers.csv user taguser@domain.com print tagmanagercontainers select csvfile tmaccounts.csv:path
+
+$ gam redirect csv ./tmworkspaces.csv user taguser@domain.com print tagmanagerworkspaces select csvfile tmcontainers.csv:path
+
+$ gam redirect csv ./tmtags.csv user taguser@domain.com print tagmanagertags select csvfile tmworkspaces.csv:path
+
+$ gam redirect csv ./tmpermissions.csv user taguser@domain.com print tagmanagerpermissions select csvfile tmaccounts.csv:path
+```
+
+Single user - Get indented keys and values data from CSV data.
+```
+$ gam redirect stdout ./tmaccounts.txt user taguser@domain.com show tagmanageraccounts 
+
+$ gam redirect stdout ./tmcontainers.txt user taguser@domain.com show tagmanagercontainers select csvfile tmaccounts.csv:path
+
+$ gam redirect stdout ./tmworkspaces.txt user taguser@domain.com show tagmanagerworkspaces select csvfile tmcontainers.csv:path
+
+$ gam redirect stdout ./tmtags.txt user taguser@domain.com show tagmanagertags select csvfile tmworkspaces.csv:path
+
+$ gam redirect stdout ./tmpermissions.txt user taguser@domain.com show tagmanagerpermissions select csvfile tmaccounts.csv:path
+```
+
+Multiple  users - Get CSV data.
+```
+$ gam redirect csv ./tmaccounts.csv multiprocess redirect stderr - multiprocess csv Users.csv gam user "~User" print tagmanageraccounts 
+
+$ gam redirect csv ./tmcontainers.csv multiprocess redirect stderr - multiprocess csv tmaccounts.csv gam user "~User" print tagmanagercontainers "~path"
+
+$ gam redirect csv ./tmworkspaces.csv multiprocess redirect stderr - multiprocess csv tmcontainers.csv gam user "~User" print tagmanagerworkspaces "~path"
+
+$ gam redirect csv ./tmtags.csv multiprocess redirect stderr - multiprocess csv tmworkspaces.csv gam user "~User" print tagmanagertags "~path"
+
+$ gam redirect csv ./tmpermissions.csv multiprocess redirect stderr - multiprocess csv tmaccounts.csv gam user "~User" print tagmanagerpermissions "~path"
+```
+
+Multiple users - Get indented keys and values data from CSV data.
+```
+$ gam redirect stdout ./tmaccounts.txt multiprocess redirect stderr - multiprocess csv Users.csv gam user "~User" show tagmanageraccounts 
+
+$ gam redirect stdout ./tmcontainers.txt multiprocess redirect stderr - multiprocess csv tmaccounts.csv gam user "~User" show tagmanagercontainers "~path"
+
+$ gam redirect stdout ./tmworkspaces.txt multiprocess redirect stderr - multiprocess csv tmcontainers.csv gam user "~User" show tagmanagerworkspaces "~path"
+
+$ gam redirect stdout ./tmtags.txt multiprocess redirect stderr - multiprocess csv tmworkspaces.csv gam user "~User" show tagmanagertags "~path"
+
+$ gam redirect stdout ./tmpermissions.txt multiprocess redirect stderr - multiprocess csv tmaccounts.csv gam  user "~User" show tagmanagerpermissions "~path"
+
+```
--- a/wiki/Version-and-Help.md
+++ b/wiki/Version-and-Help.md
@@ -1,9 +1,10 @@
+k
 # Version and Help

 Print the current version of Gam with details
 ```
 gam version
-GAM 7.12.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.14.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -15,7 +16,7 @@ Time: 2023-06-02T21:10:00-07:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.12.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.14.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -27,7 +28,7 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.12.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.14.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -64,7 +65,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/Admin/bin/gam7
 Version Check:
  Current: 5.35.08
-   Latest: 7.12.02
+   Latest: 7.14.03
 echo $?
 1
 ```
@@ -72,7 +73,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.12.02
+7.14.03
 ```
 In Linux/MacOS you can do:
 ```
@@ -82,7 +83,7 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.12.02 - https://github.com/GAM-team/GAM
+GAM 7.14.03 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
--- a/wiki/_Sidebar.md
+++ b/wiki/_Sidebar.md
@@ -1,4 +1,4 @@
-oUpdate History
+Update History
 * [GAM Updates](GamUpdates)

 Installation
@@ -97,6 +97,7 @@ Client Access
 * [Domain Shared Contacts](Domain-SharedContacts)
 * [Email Audit Monitor](Email-Audit-Monitor)
 * [Find File Owner](Find-File-Owner)
+* [Global Address List](Global-Address-List)
 * [Google Data Transfers](Google-Data-Transfers)
 * [Groups](Groups)
 * [Groups - Membership](Groups-Membership)
@@ -170,6 +171,7 @@ Service Account Access
 * [Users - Profile Photo](Users-Profile-Photo)
 * [Users - Shared Drives](Users-Shared-Drives)
 * [Users - Spreadsheets](Users-Spreadsheets)
+* [Users - Tag Manager](Users-Tag-Manager)
 * [Users - Tasks](Users-Tasks)
 * [Users - YouTube](Users-YouTube)

--- a/wiki/gam.cfg.md
+++ b/wiki/gam.cfg.md
@@ -994,6 +994,7 @@ gam update project
 gam oauth create
 gam info domain
 gam config customer_id <CustomerID> save
+gam user user@xxx.com update serviceaccount
 ```

 ### New clients
@@ -1015,7 +1016,7 @@ gam create project
 gam oauth create
 gam info domain
 gam config customer_id <CustomerID> save
-gam user user@foo.com check serviceaccount
+gam user user@foo.com update serviceaccount
 ```

 To get information about a client, select a section.