Added template to gam <UserTypeEntity> show signature

Re-enable screenshot functionality and pauses for ARM64 execution flow.

.github/ISSUE_TEMPLATE/za-bug-report.md

@@ -11,7 +11,7 @@ The issue tracker is for reporting product deficiencies. "How do I?" questions s
 
 Please confirm the following:
 * I have upgraded to the latest GAM release from https://github.com/GAM-team/GAM/releases and I still have this issue.
-* I am typing the command as described in the GAM Wiki at https://github.com/jay0lee/gam/wiki
+* I am typing the command as described in the GAM Wiki at https://github.com/GAM-team/GAM/wiki.
 
 Full steps to reproduce the issue:
 1.

.github/workflows/build.yml

@@ -153,7 +153,7 @@ jobs:
         with:
           path: |
             cache.tar.xz
-          key: gam-${{ matrix.jid }}-20251031
+          key: gam-${{ matrix.jid }}-20251218
 
       - name: Untar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'
@@ -669,8 +669,10 @@ jobs:
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
-          $url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.3.2.67/SimplySignDesktop-9.3.2.67-64-bit-en.msi"
-          $file = "SimplySignDesktop-9.3.2.67-64-bit-en.msi"
+          #$url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.3.2.67/SimplySignDesktop-9.3.2.67-64-bit-en.msi"
+          #$file = "SimplySignDesktop-9.3.2.67-64-bit-en.msi"
+          $url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.3.4.72/SimplySignDesktop-9.3.4.72-64-bit-en.msi"
+          $file = "SimplySignDesktop-9.3.4.72-64-bit-en.msi"
           Invoke-WebRequest $url -OutFile $file
           $log = "install.log" 
           $procMain = Start-Process "msiexec" "/i `"$file`" /qn /l*! `"$log`"" -NoNewWindow -PassThru
@@ -791,7 +793,8 @@ jobs:
 
       - name: Archive production artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # 4.6.2
-        if: (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && matrix.goal != 'test'
+        #if: (github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && matrix.goal != 'test'
+        if: always()
         with:
           name: gam-binaries-${{ env.GAMOS }}-${{ env.arch }}-${{ matrix.jid }}
           path: |

src/GamCommands.txt

@@ -386,6 +386,8 @@ If an item contains spaces, it should be surrounded by ".
 <ChatEmoji> ::= emojiname <ChatEmojiName> | customemojis/<String>
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMessage> ::= spaces/<String>/messages/<String>
+<ChatSection> ::= users/<String>/sections/<String> | sections/<String> | section <String>
+<ChatSectionItem> ::= users/<String>/sections/<String>/items/<String> | sections/<String>/items/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChromeProfilePermanentID> ::= <String>
@@ -512,6 +514,8 @@ If an item contains spaces, it should be surrounded by ".
 <MatterItem> ::= <UniqueID>|<String>
 <MatterState> ::= open|closed|deleted
 <MeetConferenceName> ::= conferenceRecords/<String>
+<MeetID> ::= <String>
+       Must match this Python Regular Expression: [a-z]{3}-[a-z]{4}-[a-z]{3}
 <MeetSpaceName> ::= spaces/<String> | <String>
 <MessageContent> ::=
         (message|textmessage|htmlmessage <String>)|
@@ -527,6 +531,7 @@ If an item contains spaces, it should be surrounded by ".
         (gdoc|ghtml <UserGoogleDoc>)|
         (gcsdoc|gcshtml <StorageBucketObjectName>)
 <NumberOfSeats> ::= <Number>
+<NumberRange> ::= <Number>|(<Number>/<Number>)
 <OrgUnitID> ::= id:<String>
 <OrgUnitPath> ::= /|(/<String>)+
 <OrgUnitItem> ::= <OrgUnitID>|<OrgUnitPath>
@@ -764,6 +769,7 @@ If an item contains spaces, it should be surrounded by ".
 <MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
 <NamespaceList> ::= "<Namespace>(,<Namespace>)*"
 <NotesNameList> ::= "<NotesName>(,<NotesName>)*"
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
 <OrgUnitList> ::= "<OrgUnitItem>(,<OrgUnitItem>)*"
 <OtherContactsResourceNameList> ::= "<OtherContactsResourceName>(,<OtherContactsResourceName>)*"
 <PeopleResourceNameList> ::= "<PeopleResourceName>(,<PeopleResourceName>)*"
@@ -1286,11 +1292,12 @@ Specify a collection of items by directly specifying them; the item type is dete
 
 ## Select a section from gam.cfg and process a GAM command using values from that section
 <Select> ::=
-        select <Section> [save] [verify]
+        select <Section> [save] [verify [variables <RESearchPattern>]]
 save
     Set section = <Section> in the [DEFAULT] section and write configuration data to gam.cfg
 verify
     Print the variable values for the selected section
+    Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
     Values are determined in this order: Selected section, DEFAULT section, Program default
 
 ## Display all of the sections in gam.cfg and mark the currently selected section with a *.
@@ -1314,7 +1321,7 @@ csv_input_row_drop_filter, csv_input_row_drop_filter_mode and csv_input_row_limi
 ## Set variables in gam.cfg.
 
 <Config> ::=
-        config (<VariableName> [=] <Value>)* [save] [verify]
+        config (<VariableName> [=] <Value>)* [save] [verify [variables <RESearchPattern>]]
 <VariableName> [=] <Value>
     Set <VariableName> = <Value> in the current section
     All <VariableNames> except section are allowed.
@@ -1323,6 +1330,7 @@ save
     Write configuration data to gam.cfg
 verify
     Print the variable values for the current section
+    Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`.
     Values are determined in this order: Current section, DEFAULT section, Program default
 
 ## Terminate processing of a CSV or batch file when one of the subprocesses returns a matching return code.
@@ -1737,13 +1745,16 @@ gam calendar <CalendarEntity> printacl [todrive <ToDriveAttribute>*]
 <AttendeeStatus> ::= accepted|declined|needsaction|tentative
 
 <EventAttribute> ::=
+        (allday <Date>)|
         (anyonecanaddself [<Boolean>])|
         (attachment <String> <URL>)|
         (attendee <EmailAddress>)|
         (attendeestatus [<AttendeeAttendance>] [<AttendeeStatus>] <EmailAddress>)|
         available|
+        (birthday <Date>)|
         (color <EventColorName>)|
         (colorindex|colorid <EventColorIndex>)|
+        (conferencedata meet <MeetID>)|
         (description <String>)|
         (end|endtime (allday <Date>)|<Time>)|
         (guestscaninviteothers <Boolean>)|
@@ -1751,7 +1762,7 @@ gam calendar <CalendarEntity> printacl [todrive <ToDriveAttribute>*]
         (guestscanmodify <Boolean>)|
         (guestscanseeotherguests <Boolean>)|
         guestscantseeotherguests|
-        hangoutsmeet|
+        googlemeet|hangoutsmeet|
         <JSONData>|
         (jsonattendees [charset <Charset>] <String>)|
         (jsonattendees file <FileName> [charset <Charset>])|
@@ -1762,7 +1773,7 @@ gam calendar <CalendarEntity> printacl [todrive <ToDriveAttribute>*]
         (privateproperty <PropertyKey> <PropertyValue>)|
         (range <Date> <Date>)|
         (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)|
-        (reminder <Number> email|popup))|
+        (reminder <Number> email|popup)|
         (resource <ResourceID>)|
         (selectattendees [<AttendeeAttendance>] [<AttendeeStatus>] <UserTypeEntity>)|
         (sequence <Integer>)|
@@ -1792,7 +1803,7 @@ The following attributes are equivalent:
         <EventAttribute>|
         clearattachments|
         clearattendees|
-        clearhangoutsmeet|
+        cleargooglemeet|clearhangoutsmeet|
         (clearprivateproperty <PropertyKey>)|
         clearresources|
         (clearsharedproperty <PropertyKey>)|
@@ -1818,8 +1829,10 @@ gam calendar|calendars <CalendarEntity> import event icaluid <iCalUID> <EventImp
 gam calendar|calendars <CalendarEntity> update events [<EventEntity>] [replacemode] <EventUpdateAttribute>+ [<EventNotificationAttribute>]
         [showdayofweek]
         [csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]
-gam calendar|calendars <CalendarEntity> delete events [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam calendar|calendars <CalendarEntity> purge events [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam calendar|calendars <CalendarEntity> delete events [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam calendar|calendars <CalendarEntity> purge events [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 gam calendar|calendars <CalendarEntity> wipe events
 gam calendar|calendars <CalendarEntity> move events [<EventEntity>] destination|to <CalendarItem> [<EventNotificationAttribute>]
 gam calendar|calendars <CalendarEntity> empty calendartrash
@@ -1911,7 +1924,7 @@ gam calendar|calendars <CalendarEntity> empty calendartrash
         <EventOrganizerSubfieldName>|
         originalstart|originalstarttime|
         outofofficeproperties|
-        <EventOutOfOfficePropertiesSubfieldName>
+        <EventOutOfOfficePropertiesSubfieldName>|
         privatecopy|
         recurrence|
         recurringeventid|
@@ -1942,7 +1955,7 @@ gam calendar|calendars <CalendarEntity> show events [<EventEntity>] <EventDispla
         [fields <EventFieldNameList>] [showdayofweek]
         [countsonly|formatjson]
 gam calendar|calendars <CalendarEntity> print events [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         (addcsvdata <FieldName> <String>)*
         [eventrowfilter]
         [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
@@ -1962,6 +1975,7 @@ gam calendar <CalendarEntity> printevents <EventSelectProperty>* <EventDisplayPr
         [formatjson [quotechar <Character>]] [todrive <ToDriveAttribute>*]
 
 <CalendarSettingsField> ::=
+        autoacceptinvitations|
         conferenceproperties|
         description|
         id|
@@ -1971,6 +1985,7 @@ gam calendar <CalendarEntity> printevents <EventSelectProperty>* <EventDisplayPr
 <CalendarSettingsFieldList> ::= "<CalendarSettingsField>(,<CalendarSettingsField>)*"
 
 <CalendarSettings> ::=
+        (autoacceptinvitations [<Boolean>])|
         (description <String>)|
         (location <String>)|
         (summary <String>)|
@@ -1987,10 +2002,10 @@ gam calendar|calendars <CalendarEntity> modify <CalendarSettings>+
 # Chat Bot
 
 <ChatContent> ::=
-        ((text <String>)|
-         (textfile <FileName> [charset <Charset>])|
-         (gdoc <UserGoogleDoc>)|
-         (gcsdoc <StorageBucketObjectName>))
+        (text <String>)|
+        (textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)|
+        (gcsdoc <StorageBucketObjectName>)
 
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMessage> ::= spaces/<String>/messages/<String>
@@ -2232,36 +2247,6 @@ gam print browsertokens [todrive <ToDriveAttribute>*]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 
-# Chrome Installed Apps Counts
-
-gam show chromeapps
-        [(ou <OrgUnitItem>)|(ou_and_children <OrgUnitItem>)|
-         (ous <OrgUnitList>)|(ous_and_children <OrgUnitList>)]
-        [filter <String>]
-        [orderby appname|apptype|installtype|numberofpermissions|totalinstallcount]
-        [formatjson]
-gam print chromeapps [todrive <ToDriveAttribute>*]
-        [(ou <OrgUnitItem>)|(ou_and_children <OrgUnitItem>)|
-         (ous <OrgUnitList>)|(ous_and_children <OrgUnitList>)]
-        [filter <String>]
-        [orderby appname|apptype|installtype|numberofpermissions|totalinstallcount]
-        [formatjson [quotechar <Character>]] [delimiter <Character>]
-
-gam show chromeappdevices
-        appid <AppID> apptype extension|app|theme|hostedapp|androidapp
-        [(ou <OrgUnitItem>)|(ou_and_children <OrgUnitItem>)|
-         (ous <OrgUnitList>)|(ous_and_children <OrgUnitList>)]
-        [start <Date>] [end <Date>]
-        [orderby deviceid|machine]
-        [formatjson]
-gam print chromeappdevices [todrive <ToDriveAttribute>*]
-        appid <AppID> apptype extension|app|theme|hostedapp|androidapp
-        [(ou <OrgUnitItem>)|(ou_and_children <OrgUnitItem>)|
-         (ous <OrgUnitList>)|(ous_and_children <OrgUnitList>)]
-        [start <Date>] [end <Date>]
-        [orderby deviceid|machine]
-        [formatjson [quotechar <Character>]]
-
 # Chrome Auto Update Expiration Counts
 
 gam print chromeaues [todrive <ToDriveAttribute>*]
@@ -2374,10 +2359,10 @@ gam print chromeprofilecommands <ChromeProfileNameEntity> [todrive <ToDriveAttri
 # Chrome Device Counts
 
 gam show chromedevicecounts
-        [mode active|perboottype|perreleasechannel] [date <Date>]
+        (mode all|active|perboottype|perreleasechannel)* [date <Date>]
         [formatjson]
 gam print chromedevicecounts [todrive <ToDriveAttribute>*]
-        [mode active|perboottype|perreleasechannel] [date <Date>]
+        (mode all|active|perboottype|perreleasechannel) [date <Date>]
         [formatjson [quotechar <Character>]]
 
 # Chrome Versions Counts
@@ -2486,10 +2471,18 @@ gam <CrOSTypeEntity> update action <CrOSAction> [acknowledge_device_touch_requir
         wipe_users|
         take_a_screenshot
 
-gam issuecommand cros <CrOSEntity> command <CrOSCommand> [times_to_check_status <Integer>] [doit]
-gam <CrOSTypeEntity> issuecommand command <CrOSCommand> [times_to_check_status <Integer>] [doit]
-gam getcommand cros <CrOSEntity> commandid <CommandID> [times_to_check_status <Integer>]
-gam <CrOSTypeEntity> getcommand commandid <CommandID> [times_to_check_status <Integer>]
+gam issuecommand cros <CrOSEntity> command <CrOSCommand>
+        [times_to_check_status <Integer>] [doit]
+        [csv (addcsvdata <FieldName> <String>)*]
+gam <CrOSTypeEntity> issuecommand command <CrOSCommand>
+        [times_to_check_status <Integer>] [doit]
+        [csv (addcsvdata <FieldName> <String>)*]
+gam getcommand cros <CrOSEntity> commandid <CommandID>
+        [times_to_check_status <Integer>]
+        [csv (addcsvdata <FieldName> <String>)*]
+gam <CrOSTypeEntity> getcommand commandid <CommandID>
+        [times_to_check_status <Integer>]
+        [csv (addcsvdata <FieldName> <String>)*]
 
 <CrOSAttribute> ::=
         (asset|assetid|tag <String>)|
@@ -2602,7 +2595,7 @@ gam print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
@@ -2616,6 +2609,7 @@ gam print cros [todrive <ToDriveAttribute>*] select <CrOSTypeEntity>
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
@@ -2627,7 +2621,7 @@ gam <CrOSTypeEntity> print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
@@ -3231,10 +3225,10 @@ gam course <CourseID> create|add alias <CourseAlias>
 gam course <CourseID> delete alias <CourseAlias>
 
 <CourseAnnouncementContent> ::=
-        ((text <String>)|
-         (textfile <FileName> [charset <Charset>])|
-         (gdoc <UserGoogleDoc>)|
-         (gcsdoc <StorageBucketObjectName>))
+        (text <String>)|
+        (textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)|
+        (gcsdoc <StorageBucketObjectName>)
 
 gam course <CourseID> create announcement
         <CourseAnnouncementContent> [scheduledtime <Time>] [state draft|published]
@@ -3298,6 +3292,11 @@ gam print course-participants [todrive <ToDriveAttribute>*]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
 
+gam print course-counts students|teachers [todrive <ToDriveAttribute>*]
+        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
+        [mincount <Integer>]
+        [formatjson [quotechar <Character>]]
+
 <CourseAnnouncementFieldName> ::=
         alternatelink|
         assigneemode|
@@ -3600,6 +3599,12 @@ gam show domainaliases|aliasdomains
 
 # Domain - Contacts and Global Address List
 
+<ContactNoteContent> ::=
+        <String>|
+        (file|textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)
+        (gcsdoc <StorageBucketObjectName>)
+         
 <ContactAttribute> ::=
         (additionalname|middlename <String>)|
         (address clear|(work|home|other|<String> ((formatted|unstructured <String>)|(streetaddress <String>)|(pobox <String>)|
@@ -3625,7 +3630,7 @@ gam show domainaliases|aliasdomains
         (mileage <String>)|
         (name <String>)|
         (nickname <String>)|
-        (note <NoteContent>)|
+        (note <ContactNoteContent>)|
         (occupation <String>)|
         (organization clear|(work|other|<String> <String> ((location <String>)|(department <String>)|(title <String>)|(jobdescription <String>)|(symbol <String>))* notprimary|primary))|
         (phone clear|(work|home|other|fax|work_fax|home_fax|other_fax|main|company_main|assistant|mobile|work_mobile|pager|work_pager|car|radio|callback|isdn|telex|tty_tdd|<String> <String> notprimary|primary))|
@@ -3994,7 +3999,7 @@ gam info group|groups <GroupEntity>
         [basic] <GroupFieldName>* [fields <GroupFieldNameList>] [nodeprecated]
         [ciallfields|(cifields <CIGroupFieldNameList>)]
         [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -4012,12 +4017,13 @@ gam print groups [todrive <ToDriveAttribute>*]
         [nodeprecated]
         [roles <GroupRoleList>]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [includederivedmembership]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>] [sortheaders]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
 
@@ -4048,7 +4054,8 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
+        [showallowexternal [<Boolean>]] [verifyallowexternal [<Boolean>]]
         [membernames] [showdeliverysettings]
         <MembersFieldName>* [fields <MembersFieldNameList>]
         [notsuspended|suspended] [notarchived|archived]
@@ -4059,8 +4066,9 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [(recursive [noduplicates])|includederivedmembership] [nogroupemail]
         [peoplelookup|(peoplelookupuser <EmailAddress>)]
         [unknownname <String>] [cachememberinfo [Boolean]]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
-`gam show group-members
+gam show group-members
         [([domain|domains <DomainNameEntity>] ([member|showownedby <EmailItem>]|[(query <QueryGroup>)|(queries <QueryGroupList>)]))|
          (group|group_ns|group_susp <GroupItem>)|
          (select <GroupEntity>)]
@@ -4068,7 +4076,7 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners] [depth <Number>]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -4136,7 +4144,7 @@ gam info cigroups <GroupEntity>
         [nosecurity|nosecuritysettings]
         [allfields|<CIGroupFieldName>*|(fields <CIGroupFieldNameList>)]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [formatjson]
@@ -4148,10 +4156,11 @@ gam print cigroups [todrive <ToDriveAttribute>*]
         [basic|allfields|(<CIGroupFieldName>* [fields <CIGroupFieldNameList>])]
         [roles <GroupRoleList>] [memberrestrictions]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
 
@@ -4175,11 +4184,14 @@ gam print cigroup-members [todrive <ToDriveAttribute>*]
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
+        [showallowexternal [<Boolean>]] [verifyallowexternal [<Boolean>]]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         <CIGroupMembersFieldName>* [fields <CIGroupMembersFieldNameList>]
         [minimal|basic|full]
         [(recursive [noduplicates]) | includederivedmembership] [nogroupemail]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 gam show cigroup-members
         [(cimember|ciowner <UserItem>)|(cigroup <GroupItem>)|(select <GroupEntity>)]
@@ -4187,6 +4199,7 @@ gam show cigroup-members
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [minimal|basic|full]
@@ -4315,7 +4328,7 @@ gam update deviceuserstate <DeviceUserEntity> [clientid <String>]
         [customid <String>] [assettags clear|<AssetTagList>]
         [compliantstate|compliancestate compliant|noncompliant] [managedstate clear|managed|unmanaged]
         [healthscore very_poor|poor|neutral|good|very_good] [scorereason clear|<String>]
-        (customvalue (bool|boolean <Boolean>)|(number <Integer>)|(string <String>))*
+        (customvalue clear|(bool|boolean <String> <Boolean>)|(number <String> <Integer>)|(string <String> <String>))*
 
 # Cloud Identity Policies
 
@@ -4476,22 +4489,21 @@ gam print mobile [todrive <ToDriveAttribute>*]
 <OrgUnitFieldName> ::=
         description|
         id|orgunitid|
-        inherit|blockinheritance|
         name|
         parentid|parentorgunitid|
         parent|parentorgunitpath|
         path|orgunitpath
 <OrgUnitFieldNameList> ::= "<OrgUnitFieldName>(,<OrgUnitFieldName>)*"
 
-gam create|add org|ou <OrgUnitPath> [description <String>] [parent <OrgUnitItem>] [inherit|(blockinheritance False)] [buildpath]
-gam update org|ou <OrgUnitItem> [name <String>] [description <String>] [parent <OrgUnitItem>] [inherit|(blockinheritance False)]
+gam create|add org|ou <OrgUnitPath> [description <String>] [parent <OrgUnitItem>] [buildpath]
+gam update org|ou <OrgUnitItem> [name <String>] [description <String>] [parent <OrgUnitItem>]
 gam update org|ou <OrgUnitItem> add|move <CrOSTypeEntity> [quickcrosmove [<Boolean>]]
 gam update org|ou <OrgUnitItem> add|move <UserTypeEntity>
 gam update org|ou <OrgUnitItem> sync <CrOSTypeEntity> [removetoou <OrgUnitItem>] [quickcrosmove [<Boolean>]]
 gam update org|ou <OrgUnitItem> sync <UserTypeEntity> [removetoou <OrgUnitItem>]
 gam delete org|ou <OrgUnitItem>
 
-gam update orgs|ous <OrgUnitEntity> [name <String>] [description <String>] [parent <OrgUnitItem>] [inherit|(blockinheritance False)]
+gam update orgs|ous <OrgUnitEntity> [name <String>] [description <String>] [parent <OrgUnitItem>]
 gam update orgs|ous <OrgUnitEntity> add|move <CrOSTypeEntity> [quickcrosmove [<Boolean>]]
 gam update orgs|ous <OrgUnitEntity> add|move <UserTypeEntity>
 gam update orgs|ous <OrgUnitEntity> sync <CrOSTypeEntity> [removetoou <OrgUnitItem>] [quickcrosmove [<Boolean>]]
@@ -4600,39 +4612,54 @@ gam report usage customer [todrive <ToDriveAttribute>*]
         [convertmbtogb]
 
 <ActivityApplicationName> ::=
+        accessevaluation|
         accesstransparency|access|
         admin|
+        admindataaction|
+        assignments|
         calendar|calendars|
         chat|
         chrome|
         classroom|
+        cloudsearch|
+        contacts|
         contextawareaccess|
+        datamigration|
         datastudio|
+        directorysync|
         drive|doc|docs|
         gcp|cloud|
         geminiinworkspaceapps|gemini|geminiforworkspace|
         gmail|
         gplus|currents|google+|
+        graduation|
         groups|group|
         groupsenterprise|enterprisegroups|
         jamboard|
         keep|
+        ldap|
         login|logins|
         meet|hangoutsmeet|
+        meethardware|
         mobile|devices|
+        profile|
         rules|
         saml|
+        takeout|
+        tasks|
         token|tokens|oauthtoken|
         useraccounts|
         vault
 
 gam report <ActivityApplicationName> [todrive <ToDriveAttribute>*]
         [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
+        [userisactor]
         [([start <Time>] [end <Time>])|(range <Time> <Time>)|
          yesterday|today|thismonth|(previousmonths <Integer>)]
         [filter <String> (filtertime<String> <Time>)*]
         [event|events <EventNameList>] [ip <String>]
-        [groupidfilter <String>]
+        [gmaileventtypes <NumberRangeList>]
+        [groupidfilter <String>] [resourcedetailsfilter <String>]
         [maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
         [countsonly [bydate|summary] [eventrowfilter]]
         (addcsvdata <FieldName> <String>)* [shownoactivities]
@@ -4754,6 +4781,7 @@ gam print resoldsubscriptions [todrive <ToDriveAttribute>*]
         (zipcode|postalcode <String>)
 
 <ResourceAttribute> ::=
+        (autoacceptinvitations [<Boolean>])|
         (addfeatures <FeatureNameList>)|
         (buildingid <BuildingID>)|
         (capacity <Number>)|
@@ -4769,6 +4797,7 @@ gam print resoldsubscriptions [todrive <ToDriveAttribute>*]
 
 <ResourceFieldName> ::=
         acls|
+        autoacceptinvitations|
         buildingid|
         calendar|
         capacity|
@@ -5211,11 +5240,13 @@ gam copy shareddriveacls <SharedDriveEntity> to <SharedDriveEntity>
         [adminaccess|asadmin]
         [showpermissionsmessages [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
 gam sync shareddriveacls <SharedDriveEntity> with <SharedDriveEntity>
         [adminaccess|asadmin]
         [showpermissionsmessages [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
 
 gam print shareddriveacls [todrive <ToDriveAttribute>*]
@@ -5240,11 +5271,13 @@ gam <UserTypeEntity> copy shareddriveacls <SharedDriveEntity> to <SharedDriveEnt
         [adminaccess|asadmin]
         [showpermissionsmessages [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
 gam <UserTypeEntity> sync shareddriveacls <SharedDriveEntity> with <SharedDriveEntity>
         [adminaccess|asadmin]
         [showpermissionsmessages [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
 
 gam <UserTypeEntity> print shareddriveacls [todrive <ToDriveAttribute>*]
@@ -5434,7 +5467,7 @@ gam print vaultcounts [todrive <ToDriveAttributes>*]
         [wait <Integer>]
 gam print vaultcounts [todrive <ToDriveAttributes>*]
         matter <MatterItem>
-	corpus mail|groups
+        corpus mail|groups
         [scope [all_data|held_data|unprocessed_data]]
         [(accounts <EmailAddressEntity>) | (orgunit|org|ou <OrgUnitPath>) | everyone]
         [terms <String>] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>] [timezone <TimeZone>]
@@ -5596,7 +5629,7 @@ gam create vaultquery <MatterItem> [name <String>]
         [locationquery <StringList>] [peoplequery <StringList>] [minuswords <StringList>]
         [responsestatuses <AttendeeStatus>(,<AttendeeStatus>)*] [calendarversiondate <Date>|<Time>]
         (covereddata calllogs|textmessages|voicemails)*
-	[<JSONData>]
+        [<JSONData>]
         [shownames]
         [showdetails|returnidonly|formatjson]
 
@@ -5690,6 +5723,11 @@ gam download storagefile <StorageBucketObjectName>
 <UserOrderByFieldName> ::=
         familyname|lastname|givenname|firstname|email
 
+<UserNoteContent> ::=
+        <String>|
+        (file|textfile|htmlfile <FileName> [charset <Charset>])|
+        (gdoc|ghtml <UserGoogleDoc>)
+         
 <UserBasicAttribute> ::=
         (archive|archived <Boolean>)|
         (changepassword|changepasswordatnextlogin <Boolean>)|
@@ -5703,9 +5741,7 @@ gam download storagefile <StorageBucketObjectName>
         (ipwhitelisted <Boolean>)|
         (language clear|<LanguageList>)|
         (lastname|familyname <String>)|
-        (note clear|([text_html|text_plain] <String>|
-                                            (file|htmlfile <FileName> [charset <Charset>])|
-                                            (gdoc|ghtml <UserGoogleDoc>)))|
+        (note clear|([text_html|text_plain] <UserNoteContent))|
         (ou|org|orgunitpath <OrgUnitPath>|<OrgUnitID>)
         (password (random [<Integer>])|(uniquerandom [<Integer>])|
                    blocklogin|
@@ -5928,7 +5964,7 @@ gam print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
 Print fields for specified users.
@@ -5945,7 +5981,7 @@ gam print users [todrive <ToDriveAttribute>*] select <UserTypeEntity>
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
 gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
@@ -5960,7 +5996,7 @@ gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
 The first column will always be primaryEmail; the remaining field names will be sorted if allfields, basic, full or sortheaders is specified;
@@ -6076,6 +6112,7 @@ gam <UserTypeEntity> print backupcodes|verificationcodes [todrive <ToDriveAttrib
         (summary <String>)
 
 <CalendarSettings> ::=
+        (autoacceptinvitations [<Boolean>])|
         (description <String>)|
         (location <String>)|
         (summary <String>)|
@@ -6118,7 +6155,7 @@ gam <UserTypeEntity> show calendars
         [formatjson]
 gam <UserTypeEntity> print calendars [todrive <ToDriveAttribute>*]
         [primary] <CalendarSelectProperty>* [noprimary] [nogroups] [noresources] [nosystem] [nousers]
-        [fields <CalendarListFieldList>] [permissions]
+        [fields <CalendarListFieldList>] [permissions] [oneitemperrow]
         [formatjson] [delimiter <Character>] [quotechar <Character>]
 
 Display a users calendar settings
@@ -6236,6 +6273,7 @@ gam <UserTypeEntity> transfer calendars|seccals <UserItem> [<UserCalendarEntity>
         (birthday <Date>)|
         (color <EventColorName>)|
         (colorindex|colorid <EventColorIndex>)|
+        (conferencedata meet <MeetID>)|
         (description <String>)|
         (end|endtime (allday <Date>)|<Time>)|
         (guestscaninviteothers <Boolean>)|
@@ -6243,7 +6281,7 @@ gam <UserTypeEntity> transfer calendars|seccals <UserItem> [<UserCalendarEntity>
         (guestscanmodify <Boolean>)|
         (guestscanseeotherguests <Boolean>)|
         guestscantseeotherguests|
-        hangoutsmeet|
+        googlemeet|hangoutsmeet|
         <JSONData>|
         (jsonattendees [charset <Charset>] <String>)|
         (jsonattendees file <FileName> [charset <Charset>])|
@@ -6255,6 +6293,7 @@ gam <UserTypeEntity> transfer calendars|seccals <UserItem> [<UserCalendarEntity>
         (range <Date> <Date>)|
         (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)|
         (reminder <Number> email|popup)|
+        (resource <ResourceID>)|
         (selectattendees [<AttendeeAttendance>] [<AttendeeStatus>] <UserTypeEntity>)|
         (sequence <Integer>)|
         (sharedproperty <PropertyKey> <PropertyValue>)|
@@ -6283,10 +6322,12 @@ The following attributes are equivalent:
         <EventAttribute>|
         clearattachments|
         clearattendees|
-        clearhangoutsmeet|
+        cleargooglemeet|clearhangoutsmeet|
         (clearprivateproperty <PropertyKey>)|
+        clearresources|
         (clearsharedproperty <PropertyKey>)|
         (removeattendee <EmailAddress>)|
+        (removeresource <ResourceID>)|
         (replacedescription <REMatchPattern> <RESubstitution>)|
         (selectremoveattendees <UserTypeEntity>)
 
@@ -6309,8 +6350,10 @@ gam <UserTypeEntity> import event <UserCalendarEntity> icaluid <iCalUID> <EventI
 gam <UserTypeEntity> update events <UserCalendarEntity> [<EventEntity>] [replacemode] <EventUpdateAttribute>+ [<EventNotificationAttribute>]
         [showdayofweek]
         [csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]
-gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 gam <UserTypeEntity> wipe events <UserCalendarEntity>
 gam <UserTypeEntity> move events <UserCalendarEntity> [<EventEntity>] destination|to <CalendarItem> [<EventNotificationAttribute>]
 gam <UserTypeEntity> empty calendartrash <UserCalendarEntity>
@@ -6329,13 +6372,13 @@ gam <UserTypeEntity> show events <UserCalendarEntity> [<EventEntity>] <EventDisp
         [fields <EventFieldNameList>] [showdayofweek]
         [countsonly|formatjson]
 gam <UserTypeEntity> print events <UserCalendarEntity> [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         [eventrowfilter]]
         [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
 
 gam <UserTypeEntity> update calattendees <UserCalendarEntity> <EventEntity> [anyorganizer]
         [<EventNotificationAttribute>] [splitupdate] [dryrun|doit]
-        (csv|csvfile <CSVFileInput>)
+        (csv|csvfile <CSVFileInput> endcsv)
         (delete <EmailAddress>)*
         (deleteentity <EmailAddressEntity>)*
         (add <EmailAddress>)*
@@ -6354,14 +6397,25 @@ gam <UserTypeEntity> create focustime
         [declinemode none|all|new]
         [declinemessage <String>]
         [summary <String>]
-        (timerange <Time> <Time> [recurrence <String>])+
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd N)|
+         (weekly yyyy-mm-dd N)|
+         (timerange <Time> <Time> (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*))+
+        [timezone <String>]
+        (noreminders|(reminder email|popup <Number>)+)
 
 gam <UserTypeEntity> create outofoffice
         [declinemode none|all|new]
         [declinemessage <String>]
         [summary <String>]
-        (timerange <Time> <Time> [recurrence <String>])+
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd N)|
+         (weekly yyyy-mm-dd N)|
+         (timerange <Time> <Time>) (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*)+
         [timezone <String>]
+        (noreminders|(reminder email|popup <Number>)+)
 
 gam <UserTypeEntity> create workinglocation
         (home|
@@ -6372,8 +6426,9 @@ gam <UserTypeEntity> create workinglocation
          (range yyyy-mm-dd yyyy-mm-dd)|
          (daily yyyy-mm-dd N)|
          (weekly yyyy-mm-dd N)|
-         (timerange <Time> <Time>))+
+         (timerange <Time> <Time>) (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*)+
         [timezone <String>]
+        (noreminders|(reminder email|popup <Number>)+)
 
 gam <UserTypeEntity> delete focustime|outofoffice|workinglocation
         ((date yyyy-mm-dd)|
@@ -6402,10 +6457,10 @@ gam <UserTypeEntity> print focustime|outofoffice|workinglocation
 # Users - Chat
 
 <ChatContent> ::=
-        ((text <String>)|
-         (textfile <FileName> [charset <Charset>])|
-         (gdoc <UserGoogleDoc>)|
-         (gcsdoc <StorageBucketObjectName>))
+        (text <String>)|
+        (textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)|
+        (gcsdoc <StorageBucketObjectName>)
 
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMemberList> ::= "<ChatMember>(,<ChatMember>)*"
@@ -6502,6 +6557,26 @@ gam <UserItem> print chatspaces asadmin [todrive <ToDriveAttribute>*]
         [fields <ChatSpaceFieldNameList>] [showaccessssettings]
         [formatjson [quotechar <Character>]]
 
+gam <UserTypeEntity> create chatsection
+        displayname <String>
+        [formatjson|returnidonly]
+gam <UserTypeEntity> update chatsection <ChatSection>
+        [displayname <String>]
+        [(sortorder <Integer>)|(position start|end)]
+        [formatjson]
+gam <UserTypeEntity> delete chatsection <ChatSection>
+gam <UserTypeEntity> show chatsections
+        [formatjson]
+gam <UserTypeEntity> print chatsections [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+gam <UserTypeEntity> move chatsectionitem <ChatSectionItem> to <ChatSection>
+gam <UserTypeEntity> show chatsectionitems <ChatSection>
+        [space <ChatSpace>]
+        [formatjson]
+gam <UserTypeEntity> print chatsectionitems  <ChatSection> [todrive <ToDriveAttribute>*]
+        [space <ChatSpace>]
+        [formatjson [quotechar <Character>]]
+
 gam <UserTypeEntity> create chatmember <ChatSpace>
         [type human|bot] [role member|manager|owner]
         (user <UserItem>)* (members <UserTypeEntity>)*
@@ -6812,8 +6887,13 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         <DriveFileCopyAttribute>*
         [skipids <DriveFileEntity>]
         [copysubfiles [<Boolean>]] [filenamematchpattern <REMatchPattern>]
-             [filemimetype [not] <MimeTypeList>]
-        [copysubfilesownedby any|me|others]
+             [filemimetype [not] <MimeTypeList>] [filemimetype category <MimeTypeNameList>]
+        [copysubfilesownedby
+            any|me|others|
+            users <EmailAddressList>|
+            notusers <EmailAddressList>|
+            regex <REMatchPattern>|
+            notregex <REMatchPattern>]
         [copysubfolders [<Boolean>]] [foldernamematchpattern <REMatchPattern>]
         [copysubshortcuts [<Boolean>]] [shortcutnamematchpattern <REMatchPattern>]
         [duplicatefiles overwriteolder|overwriteall|duplicatename|uniquename|skip]
@@ -6834,6 +6914,7 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         [copypermissionroles <DriveFileACLRoleList>]
         [copypermissiontypes <DriveFileACLTypeList>]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
         [copysheetprotectedranges [<Boolean>]]
         [copysheetprotectedrangesinheritedpermissions [<Boolean>]]
@@ -6860,8 +6941,8 @@ gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileNam
         [copysubfolderinheritedpermissions [<Boolean>]]
         [copysubfoldernoniheritedpermissions never|always|syncallfolders|syncupdatedfolders]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
-        [updatefilepermissions [<Boolean>]]
         [retainsourcefolders [<Boolean>]]
         [sendemailifrequired [<Boolean>]]
         [verifyorganizer [<Boolean>]]
@@ -7428,11 +7509,11 @@ gam <UserTypeEntity> show filecounts
 
 gam <UserTypeEntity> print filesharecounts [todrive <ToDriveAttribute>*]
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 gam <UserTypeEntity> show filesharecounts
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 
 <FileTreeFieldName> ::=
@@ -7500,7 +7581,7 @@ gam <UserTypeEntity> print filelist [todrive <ToDriveAttribute>*]
         [showparentsidsaslist] [showpermissionslast]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])* [delimiter <Character>]
         [stripcrsfromname]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 
 gam <UserTypeEntity> print diskusage <DriveFileEntity> [todrive <ToDriveAttribute>*]
@@ -7903,9 +7984,9 @@ gam <UserTypeEntity> show messages|threads
          [labelids <LabelIDList>]
          [quick|notquick] [max_to_show <Number>] [includespamtrash])|(ids <MessageIDEntity>)
         [labelmatchpattern <REMatchPattern>] [sendermatchpattern <REMatchPattern>]
-        [countsonly|positivecountsonly] [useronly]
+        [countsonly|positivecountsonly]
         [headers all|<SMTPHeaderList>] [dateheaderformat iso|rfc2822|<String>] [dateheaderconverttimezone [<Boolean>]]
-        [showlabels] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
+        [showlabels] [useronly] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
         [maxmessagesperthread <Number>]
         [[attachmentnamepattern <REMatchPattern>]
             [showattachments [noshowtextplain]]
@@ -7916,9 +7997,9 @@ gam <UserTypeEntity> print messages|threads [todrive <ToDriveAttribute>*]
          [labelids <LabelIDList>]
          [quick|notquick] [max_to_print <Number>] [includespamtrash])|(ids <MessageIDEntity>)
         [labelmatchpattern <REMatchPattern>] [sendermatchpattern <REMatchPattern>]
-        [countsonly|positivecountsonly] [useronly]
+        [countsonly|positivecountsonly]
         [headers all|<SMTPHeaderList>] [dateheaderformat iso|rfc2822|<String> [dateheaderconverttimezone [<Boolean>]]]
-        [showlabels] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
+        [showlabels] [useronly] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
         [maxmessagesperthread <Number>]
         [convertcrnl] [delimiter <Character>]
         [[attachmentnamepattern <REMatchPattern>]
@@ -7959,7 +8040,7 @@ gam <UserTypeEntity> signature|sig
         [html [<Boolean>]] [replyto <EmailAddress>] [default] [treatasalias <Boolean>]
         [name <String>]
         [primary]
-gam <UserTypeEntity> show signature|sig [compact|format|html]
+gam <UserTypeEntity> show signature|sig [compact|format|html|template]
         [primary|default] [verifyonly]
 gam <UserTypeEntity> print signature [compact]
         [primary|default] [verifyonly] [todrive <ToDriveAttribute>*]
@@ -8092,16 +8173,16 @@ gam <UserTypeEntity> check isinvitable [todrive <ToDriveAttribute>*]
 
 # Users - Keep Notes
 
-<NoteContent> ::=
-        ((text <String>)|
-         (textfile <FileName> [charset <Charset>])|
-         (gdoc <UserGoogleDoc>)|
-         (gcsdoc <StorageBucketObjectName>)|
-         <JSONData>)
+<KeepNoteContent> ::=
+        (text <String>)|
+        (textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)|
+        (gcsdoc <StorageBucketObjectName>)|
+        <JSONData>
 
 gam <UserTypeEntity> create note [title <String>]
         [missingtextvalue <String>]
-        <NoteContent>
+        <KeepNoteContent>
         [copyacls [copyowneraswriter]]
         [compact|formatjson|nodetails]
 
@@ -8272,12 +8353,17 @@ gam <UserItem> print meettranscripts <MeetConferenceName> [todrive <ToDriveAttri
 
 # Users - Contacts and Profiles
 
+<BiographyContent> ::=
+        <String>|
+        (file|textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)
+
 <PeopleContactAttribute> ::=
         (additionalname|middlename <String>)|
         (address clear|(work|home|other|<String> ((formatted|unstructured <String>)|(streetaddress <String>)|(pobox <String>)|
             (neighborhood <String>)|(locality <String>)|(region <String>)|(postalcode <String>)|(country <String>))* notprimary|primary))|
         (billinginfo <String>)|
-        (biography|biographies <String>|(file <FileName> [charset <Charset>])|(gdoc <UserGoogleDoc>))|
+        (biography|biographies <BiographyContent)|
         (birthday <Date>)|
         (calendar clear|(work|home|free-busy|<String> <URL> notprimary|primary))|
         (clientdata <String> <String>)|

src/GamUpdate.txt

@@ -1,3 +1,302 @@
+7.32.03
+
+Added option `template` as an additional formating option for `gam <UserTypeEntity> show signature`
+that displays just the HTML data; this simplifies capturing the data for use as input to GAM.
+```
+$ gam redirect stdout ./SigTemplate.html user user@domain.com show signature template
+$ more SigTemplate.html
+<div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)"><span style="background-color:rgb(82,208,206)">{RT}Email: {Email}{/RT}</span></p><p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)"><span style="background-color:rgb(82,208,206)">{RT}Phone: {Phone}{/RT}</span></p><p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)"><span style="background-color:rgb(82,208,206)">{RT}Mobile: {Mobile}{/RT}</span></p></div><br></div>\n</div>
+```
+
+7.32.02
+
+Added variable `oauth2_txt_lock_mode` to `gam.cfg`, the default is 644 and valid values are: 644, 664, 666.
+This value is used to set the file permissions on the `oauth2.txt.lock` file. In very special cases where
+daemon processes, e.g. Apache/httpd, are running GAM, the value 666 may have to be used.
+
+7.32.01
+
+Added option `(addcsvdata <FieldName> <String>)*` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand> csv`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID> csv` that adds additional columns of data to the CSV file output.
+* See: https://github.com/GAM-team/GAM/wiki/ChromeOS-Devices#bulk-action-example
+
+7.32.00
+
+Added option `verifyallowexternal` to `gam print cigroup-members|group-members` that causes
+GAM to only display external members in groups with `allowExternalMembers=False'.
+This option can be used to help verify that internal-only groups don't have external members.
+
+Updated option `internaldomains` for the following commands:
+```
+gam info|print groups
+gam print|show group-members
+gam info|print cigroups
+gam print|show cigroup-members
+gam <UserTypeEntity> print|show filesharecounts
+```
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+Added option `csv` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand>`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID>` so that command details are displayed in CSV format.
+This can be used to log commands issued to devices and then monitor the results.
+
+Added option `filemimetype category <MimeTypeNameList>` to `gam <UserTypeEntity> copy drivefile` to support
+copying of files based on their MimeType category.
+
+Added option `attendeeslist` to `gam calendars <CalendarEntity> print events` and `gam <UserTypeEntity> print events`
+that causes GAM to display the attendee email addresses in a single column `attendeesList`; no attendee details
+are displayed. The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
+Fixed bug in `gam sendemail ... replyto <EmailAddress>` that caused a message delivery error if
+`<EmailAddress>` did not include a domain name.
+
+Added support for users's chat sections.
+* See: https://github.com/GAM-team/GAM/wiki/Users-Chat#manage-chat-users-sections
+* This is in Deveoper Preview; you must have a `developer_preview_api_key` in `gam.cfg` to use these commands.
+
+7.31.06
+
+Added option `batchsize <Integer>` to `gam calendar <CalendarEntity> delete|purge events` and
+`gam <UserTypeEntity> delete|purge events <UserCalendarEntity>` that causes GAM to delete events
+with batch API calls rather than with individual API calls.
+
+7.31.05
+
+Added option `variables <RESearchPattern>` to `gam select section <SectionName> verify` and `gam config verify`
+that causes GAM to only display variables with names selected by `<RESearchPattern>`.
+```
+gam select School verify variables "^(customer|domain)"
+Section: School
+  customer_id = C03abc123
+  domain = school.edu
+
+gam config verify variables  'dir'
+Section: DEFAULT
+  cache_dir = ~/GamConfig/gamcache ; /Users/gamteam/GamConfig/gamcache
+  config_dir = ~/GamConfig ; /Users/gamteam/GamConfig
+  drive_dir = ~/GamWork ; /Users/gamteam/GamWork
+  gmail_cse_incert_dir = ~/GmailCSE/Certs ; /Users/gamteam/GmailCSE/Certs
+  gmail_cse_inkey_dir = ~/GmailCSE/Keys ; /Users/gamteam/GmailCSE/Keys
+  input_dir = .
+```
+
+7.31.04
+
+Fixed bug in `gam report admin|chrome` that caused to events to not be displayed.
+
+Updated `gam <UserTypeEntity> print|show messages|threads ... query <QueryGmail>` to display the query.
+
+7.31.03
+
+Due to the following Calendar API update, the `gam <UserTypeEntity> transfer calendars` command has been removed.
+* See: https://developers.google.com/workspace/calendar/release-notes#October_27_2025
+Data ownership can be transferred in the Google Calendar UI.
+
+7.31.02
+
+Added the following options to `gam <UserTypeEntity> copy drivefile`
+to limit copying to those files owned by selected users.
+* `copysubfilesownedby users <EmailAddressList>` - Only files owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby notusers <EmailAddressList>` - Only files not owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby regex <REMatchPattern>` - Only files owned by users whose email addresses match `<REMatchPattern>` are copied.
+* `copysubfilesownedby notregex <REMatchPattern>` - Only files owned by users whose email addresses do not match `<REMatchPattern>` are copied.
+
+7.31.01
+
+Code cleanup for `addcsvdata <FieldName> <String>`.
+
+7.31.00
+
+Fixed bug in `gam report chrome (user <UserItem>)|(select <UserTypeEntity>)` where no activities were returned.
+`report chrome` does not use the parameter `userKey=<EmailAddress>` as do other applications but requires
+parameter `filter DEVICE_USER==<EmailAddress>`.
+
+Updated `gam report admin (user <UserItem>)|(select <UserTypeEntity>)` to use parameter `filter USER_EMAIL==<EmailAddress>`
+to display activiities affecting the user `<EmailAddress>`. Use option `userisactor` to use the parameter `userKey=<EmailAddress>`
+that displays activities where user `<EmailAddress>` executed the command that generated the activity.
+
+Fixed bug in `gam print cros|filelist|users ... (addcsvdata <FieldName> <String>)+ formatjson` where the `addcsvdata` columns
+were not displayed but the additional field values were included in the JSON data. Now, the `addcsvdata` columns
+are displayed but the additional field values are only included in the JSON data when option `includdecsvdatainjson` is specified.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroups|groups`
+that adds additional columns of data to the CSV file output.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroupmembere|group-members`
+that adds additional columns of data to the CSV file output.
+
+7.30.05
+
+Added option `gmaileventtypes <NumberRangeList>` to `gam report gmail` that can be used to limit the event types displayed.
+```
+<NumberRange> ::= <Number>|(<Number>/<Number>)
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
+
+gam report gmail user user@domain.com gmaileventtypes 1,10/11
+```
+* See: https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gmail
+
+Updated sorting of column headers in `gam report <ActivityApplicationName>`.
+
+7.30.04
+
+Updated `gam report gmail` to avoid the following error when incomplete start/end time information is provided.
+```
+ERROR: Invalid request: Start time and end time should both be provided, and the scan duration should not be greater than 30 days.
+```
+* No time information provided - GAM sets `range -30d today`
+* Only `start <Time>`  provided - GAM sets `end <Time>+30d`
+* Only `end <Time>` provided - GAM sets `start <Time>-30d`
+
+7.30.03
+
+Updated `gam report <ActivityApplicationName>` to reflect the changes described here:
+* See: https://workspaceupdates.googleblog.com/2025/12/google-workspace-audit-log-api.html
+
+Added option `resourcedetailsfilter <String>` to `gam report <ActivityApplicationName>` described here:
+* See: https://developers.google.com/workspace/admin/reports/reference/rest/v1/activities/list#query-parameters
+
+For `gam <UserTypeEntity> print <Objects>`, expanded the list of `<Objects>` covered by `gam.cfg csv_output_users_audit = True`.
+
+7.30.02
+
+Added option `conferencedata meet <MeetID>` to `<EventAttribute>` that allows specifying
+a reference to an existing Google Meet when creating/updating a calendar event.
+
+Upgraded to Python 3.14.2.
+
+7.30.01
+
+Fixed bug introduced in 7.30.00 that caused errors when reading CSV files.
+
+Added the following options to `gam <UserTypeEntity> create focustime|outofoffice`:
+```
+((date yyyy-mm-dd)|
+ (range yyyy-mm-dd yyyy-mm-dd)|
+ (daily yyyy-mm-dd N)|
+ (weekly yyyy-mm-dd N))
+```
+
+Added the following options to `gam <UserTypeEntity> create focustime|outofoffice|workinglocation`:
+```
+noreminders|(reminder email|popup <Number>)+
+```
+
+7.30.00
+
+Added `input_dir` directory variable to `gam.cfg` that is used to select a directory for reading files with non-absolute file names.
+The default is '.' that matches the current behavior where these files are read from the current working directory.
+This will be most useful in multiple domain situations where each domain will have distinct `drive_dir` and `input_dir` values.
+
+Added support for the new resource calendar setting `autoAcceptInvitations`.
+
+7.29.04
+
+Updated `gam delete chromepolicy chrome.users.apps.InstallType ou <OrgUnitItem> appid <AppID>`
+to allow deleting an app, i.e., explicitly remove it from management. `<OrgUnitItem>` must specify where it was added for management.
+
+7.29.03
+
+Remove debugging message from `gam <UserTypeEntity> move drivefile <DriveFileEntity>`.
+
+7.29.02
+
+Fixed bug in `gam <UserTypeEntity> move drivefile <DriveFileEntity>` where the following options
+were only applied to top level files or folders re-created in the destination. Now, domain
+and email address mappings apply to all moved files/folders.
+```
+excludepermissionsfromdomains <DomainNameList>
+includepermissionsfromdomains <DomainNameList>
+mappermissionsdomain <DomainName> <DomainName>
+mappermissionsemail <EmailAddress> <EmailAddress>
+mappermissionsemailfile <CSVFileInput> endcsv
+```
+
+Upgraded to Python 3.14.1.
+
+7.29.01
+
+Added option `oneitemperrow` to `gam <UserTypeEntity> print calendars ... permissions` to have each of a
+calendar's permissions displayed on a separate row with all of the other calendar fields.
+
+Updated `gam yubikey reset_piv` to handle YubiKey firmware updates that caused an error.
+
+7.29.00
+
+Added options `mappermissionsemail <EmailAddress> <EmailAddress>` and ` mappermissionsemailfile <CSVFileInput> endcsv`
+to these commands:
+```
+gam [<UserTypeEntity>] copy shareddriveacls <SharedDriveEntity> to <SharedDriveEntity>
+gam [<UserTypeEntity>] sync shareddriveacls <SharedDriveEntity> with <SharedDriveEntity>
+gam <UserTypeEntity> copy drivefile <DriveFileEntity>
+gam <UserTypeEntity> move drivefile <DriveFileEntity>
+```
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>`
+in the source will be modified to reference the second `<EmailAddress>` in the destination.
+
+Bulk permission email address mapping can be specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
+These options will be most useful with inter-workspace Shared Drive copies and moves.
+
+7.28.13
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print messages`
+that adds additional columns of data to the CSV file output.
+
+7.28.12
+
+Updated `gam delete project` to handle the following error:
+```
+ERROR: 400: failedPrecondition - Project not active
+```
+
+7.28.11
+
+Removed all options/fields referencing inheritance from `gam create|update|info|print org` as this option/field is deprecated.
+
+7.28.10
+
+Added a command `gam print course-counts` that dsplays the count of the number of courses in which a teacher or student is a participant.
+
+* See: https://github.com/GAM-team/GAM/wiki/Classroom-Membership#display-course-counts-for-teachers-students
+
+7.28.09
+
+Fixed bug in `gam print cigroups ... descriptionmatchpattern [not] <REMatchPattern>` that caused a trap.
+
+7.28.08
+
+Updated `gam <UserTypeEntity> print|show chatmessages` to cache the sender UID to email address
+map so that each sender UID only has to be looked up once; this improves performance.
+
+7.28.07
+
+Fixed bug in `gam report users ... aggregatebydate|aggregatebyuser` where `accounts:used_quota_in_percentage` was incorrectly displayed.
+
+7.28.06
+
+Updated `gam <UserTypeEntity> info|print|show calendars` and
+`gam calendars <CalendarEntity> print|show settings` to display the
+new `dataOwner` field as described under `Additional details` below.
+
+* See: https://workspaceupdates.googleblog.com/2025/11/secondary-calendar-management-with-dedicated-owners.html
+
+7.28.04
+
+Updated commands that display Chrome device counts to display the date in the output.
+
+* See: https://github.com/GAM-team/GAM/wiki/Chrome-Device-Counts
+
+7.28.03
+
+Improved commands to display Chrome device counts.
+
+* See: https://github.com/GAM-team/GAM/wiki/Chrome-Device-Counts
+
 7.28.02
 
 Added commands to display Chrome device counts.
@@ -17291,7 +17590,7 @@ Current version of Gam with drive_v3_name_names = false
 Owner,title,parents,parents.0.id,parents.1.id
 testuser@domain.com,TestFile,2,PPPP1111,PPPP2222
 
-Current        version        of Gam with drive_v3_name_names        = true
+Current version of Gam with drive_v3_name_names = true
 Owner,name,parents
 testuser@domain.com,TestFile,PPPP1111 PPPP2222
 

src/gam/gamlib/glapi.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -32,6 +32,7 @@ CHAT_EVENTS = 'chatevents'
 CHAT_MEMBERSHIPS = 'chatmemberships'
 CHAT_MEMBERSHIPS_ADMIN = 'chatmembershipsadmin'
 CHAT_MESSAGES = 'chatmessages'
+CHAT_SECTIONS = 'chatsections'
 CHAT_SPACES = 'chatspaces'
 CHAT_SPACES_ADMIN = 'chatspacesadmin'
 CHAT_SPACES_DELETE = 'chatspacesdelete'
@@ -50,6 +51,7 @@ CLOUDIDENTITY_INBOUND_SSO = 'cloudidentityinboundsso'
 CLOUDIDENTITY_ORGUNITS = 'cloudidentityorgunits'
 CLOUDIDENTITY_ORGUNITS_BETA = 'cloudidentityorgunitsbeta'
 CLOUDIDENTITY_POLICY = 'cloudidentitypolicy'
+CLOUDIDENTITY_POLICY_BETA = 'cloudidentitypolicybeta'
 CLOUDIDENTITY_USERINVITATIONS = 'cloudidentityuserinvitations'
 CLOUDRESOURCEMANAGER = 'cloudresourcemanager'
 CONTACTS = 'contacts'
@@ -228,6 +230,7 @@ _INFO = {
   CHAT_MEMBERSHIPS: {'name': 'Chat API - Memberships', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_MEMBERSHIPS_ADMIN: {'name': 'Chat API - Memberships Admin', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_MESSAGES: {'name': 'Chat API - Messages', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
+  CHAT_SECTIONS: {'name': 'Chat API - User Sections', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_SPACES: {'name': 'Chat API - Spaces', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_SPACES_ADMIN: {'name': 'Chat API - Spaces Admin', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_SPACES_DELETE: {'name': 'Chat API - Spaces Delete', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
@@ -245,6 +248,7 @@ _INFO = {
   CLOUDIDENTITY_ORGUNITS: {'name': 'Cloud Identity API - OrgUnits', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDIDENTITY_ORGUNITS_BETA: {'name': 'Cloud Identity API - OrgUnits Beta', 'version': 'v1beta1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDIDENTITY_POLICY: {'name': 'Cloud Identity API - Policy', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
+  CLOUDIDENTITY_POLICY_BETA: {'name': 'Cloud Identity API - Policy Beta', 'version': 'v1beta1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDIDENTITY_USERINVITATIONS: {'name': 'Cloud Identity API - User Invitations', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDRESOURCEMANAGER: {'name': 'Cloud Resource Manager API v3', 'version': 'v3', 'v2discovery': True},
   CONTACTS: {'name': 'Contacts API', 'version': 'v3', 'v2discovery': False},
@@ -398,6 +402,11 @@ _CLIENT_SCOPES = [
    'subscopes': READONLY,
    'roByDefault': True,
    'scope': 'https://www.googleapis.com/auth/cloud-identity.policies'},
+  {'name': 'Cloud Identity API - Policy Beta',
+   'api': CLOUDIDENTITY_POLICY_BETA,
+   'subscopes': [],
+   'offByDefault': True,
+   'scope': 'https://www.googleapis.com/auth/cloud-identity.policies'},
   {'name': 'Cloud Identity API - User Invitations',
    'api': CLOUDIDENTITY_USERINVITATIONS,
    'subscopes': READONLY,
@@ -587,6 +596,11 @@ _SVCACCT_SCOPES = [
    'api': CHAT_MESSAGES,
    'subscopes': READONLY,
    'scope': 'https://www.googleapis.com/auth/chat.messages'},
+  {'name': 'Chat API - User Sections',
+   'api': CHAT_SECTIONS,
+   'offByDefault': True,
+   'subscopes': READONLY,
+   'scope': 'https://www.googleapis.com/auth/chat.users.sections'},
   {'name': 'Chat API - Spaces',
    'api': CHAT_SPACES,
    'subscopes': READONLY,

src/gam/gamlib/glcfg.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -157,7 +157,7 @@ DEVELOPER_PREVIEW_API_KEY = 'developer_preview_api_key'
 DEVICE_MAX_RESULTS = 'device_max_results'
 # Domain obtained from gam.cfg or oauth2.txt
 DOMAIN = 'domain'
-# Google Drive download directory
+# directory for file output
 DRIVE_DIR = 'drive_dir'
 # When retrieving lists of Drive files/folders from API, how many should be retrieved in each chunk
 DRIVE_MAX_RESULTS = 'drive_max_results'
@@ -177,6 +177,8 @@ EXTRA_ARGS = 'extra_args'
 GMAIL_CSE_INCERT_DIR = 'gmail_cse_incert_dir'
 # Gmail CSE KACL wrapped key files
 GMAIL_CSE_INKEY_DIR = 'gmail_cse_inkey_dir'
+# directory for file input
+INPUT_DIR = 'input_dir'
 # When processing items in batches, how many seconds should GAM wait between batches
 INTER_BATCH_WAIT = 'inter_batch_wait'
 # When retrieving lists of licenses from API, how many should be retrieved in each chunk
@@ -216,6 +218,8 @@ NUM_TBATCH_THREADS = 'num_tbatch_threads'
 NUM_THREADS = 'num_threads'
 # Path to oauth2.txt
 OAUTH2_TXT = 'oauth2_txt'
+# File permissions for oauth2.txt.lock
+OAUTH2_TXT_LOCK_MODE = 'oauth2_txt_lock_mode'
 # Path to oauth2service.json
 OAUTH2SERVICE_JSON = 'oauth2service_json'
 # Output date format, empty defalts to ISOFormat
@@ -394,6 +398,7 @@ Defaults = {
   EXTRA_ARGS: '',
   GMAIL_CSE_INCERT_DIR: '',
   GMAIL_CSE_INKEY_DIR: '',
+  INPUT_DIR: '.',
   INTER_BATCH_WAIT: '0',
   LICENSE_MAX_RESULTS: '100',
   LICENSE_SKUS: '',
@@ -413,6 +418,7 @@ Defaults = {
   NUM_TBATCH_THREADS: '2',
   NUM_THREADS: '5',
   OAUTH2_TXT: FN_OAUTH2_TXT,
+  OAUTH2_TXT_LOCK_MODE: '644',
   OAUTH2SERVICE_JSON: FN_OAUTH2SERVICE_JSON,
   OUTPUT_DATEFORMAT: '',
   OUTPUT_TIMEFORMAT: '',
@@ -564,6 +570,7 @@ VAR_INFO = {
   EXTRA_ARGS: {VAR_TYPE: TYPE_FILE, VAR_SIGFILE: FN_EXTRA_ARGS_TXT, VAR_SFFT: ('', FN_EXTRA_ARGS_TXT), VAR_ACCESS: os.R_OK},
   GMAIL_CSE_INCERT_DIR: {VAR_TYPE: TYPE_DIRECTORY},
   GMAIL_CSE_INKEY_DIR: {VAR_TYPE: TYPE_DIRECTORY},
+  INPUT_DIR: {VAR_TYPE: TYPE_DIRECTORY},
   INTER_BATCH_WAIT: {VAR_TYPE: TYPE_FLOAT, VAR_LIMITS: (0.0, 60.0)},
   LICENSE_MAX_RESULTS: {VAR_TYPE: TYPE_INTEGER, VAR_LIMITS: (10, 1000)},
   LICENSE_SKUS: {VAR_TYPE: TYPE_STRING, VAR_LIMITS: (0, None)},
@@ -583,6 +590,7 @@ VAR_INFO = {
   NUM_TBATCH_THREADS: {VAR_TYPE: TYPE_INTEGER, VAR_LIMITS: (1, 1000)},
   NUM_THREADS: {VAR_TYPE: TYPE_INTEGER, VAR_ENVVAR: 'GAM_THREADS', VAR_LIMITS: (1, 1000)},
   OAUTH2_TXT: {VAR_TYPE: TYPE_FILE, VAR_ENVVAR: 'OAUTHFILE', VAR_ACCESS: os.R_OK | os.W_OK},
+  OAUTH2_TXT_LOCK_MODE: {VAR_TYPE: TYPE_CHOICE, VAR_CHOICES: {'644': 0o644, '664': 0o664, '666': 0o666}},
   OAUTH2SERVICE_JSON: {VAR_TYPE: TYPE_FILE, VAR_ENVVAR: 'OAUTHSERVICEFILE', VAR_ACCESS: os.R_OK | os.W_OK},
   OUTPUT_DATEFORMAT: {VAR_TYPE: TYPE_STRING, VAR_LIMITS: (0, None)},
   OUTPUT_TIMEFORMAT: {VAR_TYPE: TYPE_STRING, VAR_LIMITS: (0, None)},

src/gam/gamlib/glclargs.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -751,6 +751,10 @@ class GamCLArgs():
   ARG_CHATMEMBERS = 'chatmembers'
   ARG_CHATMESSAGE = 'chatmessage'
   ARG_CHATMESSAGES = 'chatmessages'
+  ARG_CHATSECTION = 'chatsection'
+  ARG_CHATSECTIONS = 'chatsections'
+  ARG_CHATSECTIONITEM = 'chatsectionitem'
+  ARG_CHATSECTIONITEMS = 'chatsectionitems'
   ARG_CHATSPACE = 'chatspace'
   ARG_CHATSPACES = 'chatspaces'
   ARG_CHATSPACEDM = 'chatspacedm'
@@ -788,6 +792,7 @@ class GamCLArgs():
   ARG_CLASSIFICATIONLABELPERMISSIONS = 'classificationlabelpermissions'
   ARG_CLASS = 'class'
   ARG_CLASSES = 'classes'
+  ARG_CLASSCOUNTS = 'classcounts'
   ARG_CLASSPARTICIPANTS = 'classparticipants'
   ARG_CLASSROOMINVITATION = 'classroominvitation'
   ARG_CLASSROOMINVITATIONS = 'classroominvitations'
@@ -806,6 +811,7 @@ class GamCLArgs():
   ARG_COURSE = 'course'
   ARG_COURSES = 'courses'
   ARG_COURSEANNOUNCEMENTS = 'courseannouncements'
+  ARG_COURSECOUNTS = 'coursecounts'
   ARG_COURSEMATERIALS = 'coursematerials'
   ARG_COURSEPARTICIPANTS = 'courseparticipants'
   ARG_COURSESTUDENTGROUP = 'coursestudentgroup'
@@ -922,6 +928,8 @@ class GamCLArgs():
   ARG_GUARDIANINVITE = 'guardianinvite'
   ARG_GUARDIANINVITATION = 'guardianinvitation'
   ARG_GUARDIANINVITATIONS = 'guardianinvitations'
+  ARG_GUESTUSER = 'guestuser'
+  ARG_GUESTUSERS = 'guestusers'
   ARG_HOLD = 'hold'
   ARG_HOLDS = 'holds'
   ARG_IMAP = 'imap'
@@ -1155,6 +1163,7 @@ class GamCLArgs():
   OB_CHAT_MEMBER = 'ChatMember'
   OB_CHAT_MESSAGE = 'ChatMessage'
   OB_CHAT_MESSAGE_ID = 'ChatMessageID'
+  OB_CHAT_SECTION = 'ChatSection'
   OB_CHAT_SPACE = 'ChatSpace'
   OB_CHAT_SPACE_LIST = 'ChatSpaceList'
   OB_CHAT_THREAD = 'ChatThread'
@@ -1276,6 +1285,7 @@ class GamCLArgs():
   OB_MATTER_ITEM = 'MatterItem'
   OB_MATTER_ITEM_LIST = 'MatterItemList'
   OB_MEET_CONFERENCE_NAME = 'MeetConferenceName'
+  OB_MEET_ID = 'MeetID'
   OB_MESSAGE_ID = 'MessageID'
   OB_MIMETYPE = 'MimeType'
   OB_MIMETYPE_LIST = 'MimeTypeList'
@@ -1283,6 +1293,7 @@ class GamCLArgs():
   OB_MOBILE_ENTITY = 'MobileEntity'
   OB_NETWORK_ID = 'networkID'
   OB_NAME = 'Name'
+  OB_NUMBER_RANGE_LIST = 'NumberRangeList'
   OB_ORGANIZER_TYPE_LIST = 'OrganizerTypeList'
   OB_ORGUNIT_ENTITY = 'OrgUnitEntity'
   OB_ORGUNIT_ITEM = 'OrgUnitItem'

src/gam/gamlib/glentity.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -97,6 +97,8 @@ class GamEntity():
   CHAT_MESSAGE = 'chms'
   CHAT_MESSAGE_ID = 'chmi'
   CHAT_OWNER_USER = 'chou'
+  CHAT_SECTION = 'chse'
+  CHAT_SECTION_ITEM = 'chsi'
   CHAT_SPACE = 'chsp'
   CHAT_THREAD = 'chth'
   CHILD_ORGANIZATIONAL_UNIT = 'corg'
@@ -251,6 +253,7 @@ class GamEntity():
   GUARDIAN = 'guar'
   GUARDIAN_INVITATION = 'gari'
   GUARDIAN_AND_INVITATION = 'gani'
+  GUEST_USER = 'gstu'
   IAM_POLICY = 'iamp'
   IMAP_ENABLED = 'imap'
   INBOUND_SSO_ASSIGNMENT = 'insa'
@@ -356,7 +359,7 @@ class GamEntity():
   SNIPPETS_ENABLED = 'snip'
   SSO_KEY = 'ssok'
   SSO_SETTINGS = 'ssos'
-  SOURCE_USER = 'src'
+  SOURCE_USER = 'srcu'
   SPREADSHEET = 'sprd'
   SPREADSHEET_RANGE = 'ssrn'
   START_TIME = 'strt'
@@ -465,6 +468,8 @@ class GamEntity():
     CHAT_MEMBER_GROUP: ['Chat Group Members', 'Chat Group Member'],
     CHAT_MEMBER_USER: ['Chat User Members', 'Chat User Member'],
     CHAT_OWNER_USER: ['Chat User Owners', 'Chat User Owner'],
+    CHAT_SECTION: ['Chat User Sections', 'Chat User Section'],
+    CHAT_SECTION_ITEM: ['Chat User Section Items', 'Chat User Section Item'],
     CHAT_SPACE: ['Chat Spaces', 'Chat Space'],
     CHAT_THREAD: ['Chat Threads', 'Chat Thread'],
     CHILD_ORGANIZATIONAL_UNIT: ['Child Organizational Units', 'Child Organizational Unit'],
@@ -616,6 +621,7 @@ class GamEntity():
     GROUP_MEMBERSHIP_TREE: ['Group Membership Trees', 'Group Membership Tree'],
     GROUP_SETTINGS: ['Group Settings', 'Group Settings'],
     GROUP_TREE: ['Group Trees', 'Group Tree'],
+    GUEST_USER: ['Guest Users', 'Guest User'],
     GUARDIAN: ['Guardians', 'Guardian'],
     GUARDIAN_INVITATION: ['Guardian Invitations', 'Guardian Invitation'],
     GUARDIAN_AND_INVITATION: ['Guardians and Invitations', 'Guardian and Invitation'],

src/gam/gamlib/glgapi.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -42,6 +42,7 @@ CANNOT_DELETE_PERMISSION = 'cannotDeletePermission'
 CANNOT_DELETE_PRIMARY_CALENDAR = 'cannotDeletePrimaryCalendar'
 CANNOT_DELETE_PRIMARY_SENDAS = 'cannotDeletePrimarySendAs'
 CANNOT_DELETE_RESOURCE_WITH_CHILDREN = 'cannotDeleteResourceWithChildren'
+CANNOT_MODIFY_ACL_OF_CALENDAR_OWNER = 'cannotModifyAclOfCalendarOwner'
 CANNOT_MODIFY_INHERITED_PERMISSION = 'cannotModifyInheritedPermission'
 CANNOT_MODIFY_INHERITED_TEAMDRIVE_PERMISSION = 'cannotModifyInheritedTeamDrivePermission'
 CANNOT_MODIFY_RESTRICTED_LABEL = 'cannotModifyRestrictedLabel'
@@ -55,6 +56,7 @@ CANNOT_SHARE_GROUPS_WITHLINK = 'cannotShareGroupsWithLink'
 CANNOT_SHARE_USERS_WITHLINK = 'cannotShareUsersWithLink'
 CANNOT_SHARE_TEAMDRIVE_TOPFOLDER_WITH_ANYONEORDOMAINS = 'cannotShareTeamDriveTopFolderWithAnyoneOrDomains'
 CANNOT_SHARE_TEAMDRIVE_WITH_NONGOOGLE_ACCOUNTS = 'cannotShareTeamDriveWithNonGoogleAccounts'
+CANNOT_UNSUBSCRIBE_FROM_OWNED_CALENDAR = 'cannotUnsubscribeFromOwnedCalendar'
 CANNOT_UPDATE_PERMISSION = 'cannotUpdatePermission'
 CONDITION_NOT_MET = 'conditionNotMet'
 CONFLICT = 'conflict'
@@ -179,6 +181,7 @@ TEAMDRIVES_SHARING_RESTRICTION_NOT_ALLOWED = 'teamDrivesSharingRestrictionNotAll
 TEAMDRIVES_SHORTCUT_FILE_NOT_SUPPORTED = 'teamDrivesShortcutFileNotSupported'
 TIME_RANGE_EMPTY = 'timeRangeEmpty'
 TRANSIENT_ERROR = 'transientError'
+UNIMPLEMENTED_ERROR = 'unimplementedError'
 UNKNOWN_ERROR = 'unknownError'
 UNSUPPORTED_LANGUAGE_CODE = 'unsupportedLanguageCode'
 UNSUPPORTED_SUPERVISED_ACCOUNT = 'unsupportedSupervisedAccount'
@@ -195,7 +198,7 @@ ACTIVITY_THROW_REASONS = [SERVICE_NOT_AVAILABLE, BAD_REQUEST]
 ALERT_THROW_REASONS = [SERVICE_NOT_AVAILABLE, AUTH_ERROR, PERMISSION_DENIED]
 CALENDAR_THROW_REASONS = [SERVICE_NOT_AVAILABLE, AUTH_ERROR, NOT_A_CALENDAR_USER]
 CIGROUP_CREATE_THROW_REASONS = [SERVICE_NOT_AVAILABLE, ALREADY_EXISTS, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_ARGUMENT, PERMISSION_DENIED, FAILED_PRECONDITION]
-CIGROUP_GET_THROW_REASONS = [SERVICE_NOT_AVAILABLE, NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, SYSTEM_ERROR, PERMISSION_DENIED]
+CIGROUP_GET_THROW_REASONS = [SERVICE_NOT_AVAILABLE, NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, INVALID_ARGUMENT, SYSTEM_ERROR, PERMISSION_DENIED]
 CIGROUP_LIST_THROW_REASONS = [SERVICE_NOT_AVAILABLE, RESOURCE_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, INVALID_ARGUMENT, SYSTEM_ERROR, PERMISSION_DENIED]
 CIGROUP_LIST_USERKEY_THROW_REASONS = CIGROUP_LIST_THROW_REASONS+[INVALID_ARGUMENT]
 CIGROUP_UPDATE_THROW_REASONS = [SERVICE_NOT_AVAILABLE, NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS,
@@ -405,6 +408,8 @@ class cannotDeletePrimarySendAs(Exception):
   pass
 class cannotDeleteResourceWithChildren(Exception):
   pass
+class cannotModifyAclOfCalendarOwner(Exception):
+  pass
 class cannotModifyInheritedPermission(Exception):
   pass
 class cannotModifyInheritedTeamDrivePermission(Exception):
@@ -431,6 +436,8 @@ class cannotShareTeamDriveTopFolderWithAnyoneOrDomains(Exception):
   pass
 class cannotShareTeamDriveWithNonGoogleAccounts(Exception):
   pass
+class cannotUnsubscribeFromOwnedCalendar(Exception):
+  pass
 class cannotUpdatePermission(Exception):
   pass
 class conditionNotMet(Exception):
@@ -671,6 +678,8 @@ class timeRangeEmpty(Exception):
   pass
 class transientError(Exception):
   pass
+class unimplementedError(Exception):
+  pass
 class unknownError(Exception):
   pass
 class unsupportedLanguageCode(Exception):
@@ -710,6 +719,7 @@ REASON_EXCEPTION_MAP = {
   CANNOT_DELETE_PRIMARY_CALENDAR: cannotDeletePrimaryCalendar,
   CANNOT_DELETE_PRIMARY_SENDAS: cannotDeletePrimarySendAs,
   CANNOT_DELETE_RESOURCE_WITH_CHILDREN: cannotDeleteResourceWithChildren,
+  CANNOT_MODIFY_ACL_OF_CALENDAR_OWNER: cannotModifyAclOfCalendarOwner,
   CANNOT_MODIFY_INHERITED_PERMISSION: cannotModifyInheritedPermission,
   CANNOT_MODIFY_INHERITED_TEAMDRIVE_PERMISSION: cannotModifyInheritedTeamDrivePermission,
   CANNOT_MODIFY_RESTRICTED_LABEL: cannotModifyRestrictedLabel,
@@ -723,6 +733,7 @@ REASON_EXCEPTION_MAP = {
   CANNOT_SHARE_USERS_WITHLINK: cannotShareUsersWithLink,
   CANNOT_SHARE_TEAMDRIVE_TOPFOLDER_WITH_ANYONEORDOMAINS: cannotShareTeamDriveTopFolderWithAnyoneOrDomains,
   CANNOT_SHARE_TEAMDRIVE_WITH_NONGOOGLE_ACCOUNTS: cannotShareTeamDriveWithNonGoogleAccounts,
+  CANNOT_UNSUBSCRIBE_FROM_OWNED_CALENDAR: cannotUnsubscribeFromOwnedCalendar,
   CANNOT_UPDATE_PERMISSION: cannotUpdatePermission,
   CONDITION_NOT_MET: conditionNotMet,
   CONFLICT: conflict,
@@ -843,6 +854,7 @@ REASON_EXCEPTION_MAP = {
   TEAMDRIVES_SHORTCUT_FILE_NOT_SUPPORTED: teamDrivesShortcutFileNotSupported,
   TIME_RANGE_EMPTY: timeRangeEmpty,
   TRANSIENT_ERROR: transientError,
+  UNIMPLEMENTED_ERROR: unimplementedError,
   UNKNOWN_ERROR: unknownError,
   UNSUPPORTED_LANGUAGE_CODE: unsupportedLanguageCode,
   UNSUPPORTED_SUPERVISED_ACCOUNT: unsupportedSupervisedAccount,

src/gam/gamlib/glglobals.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #

src/gam/gamlib/glmsgs.py

@@ -355,6 +355,7 @@ LESS_THAN_1_SECOND = 'less than 1 second'
 LIST_CHROMEOS_INVALID_INPUT_PAGE_TOKEN_RETRY = 'List ChromeOSdevices Invalid Input: pageToken retry'
 LOGGING_INITIALIZATION_ERROR = 'Logging initialization error: {0}'
 LOOKING_UP_GOOGLE_UNIQUE_ID = 'Looking up Google Unique ID'
+MAP_PERMISSIONS_EMAIL_FILE_HEADERS_REQUIRED = '{0} <CSVFileInput> requires headers "sourceEmail" and "destinationEmail"'
 MARKED_AS = 'Marked as'
 MATCHED_THE_FOLLOWING = 'Matched the following'
 MATTER_NOT_OPEN = 'Matter needs to be open, current state is: {0}'

src/gam/gamlib/yubikey.py

@@ -19,12 +19,11 @@
 """YubiKey"""
 
 import base64
+from datetime import datetime, timedelta
 from secrets import SystemRandom
 import string
 import sys
 
-import arrow
-
 from gam import mplock
 
 from gam import systemErrorExit
@@ -41,7 +40,6 @@ from ykman.piv import generate_self_signed_certificate, generate_chuid
 from yubikit.piv import DEFAULT_MANAGEMENT_KEY, \
                         InvalidPinError, \
                         KEY_TYPE, \
-                        MANAGEMENT_KEY_TYPE, \
                         PIN_POLICY, \
                         PivSession, \
                         OBJECT_ID, \
@@ -149,17 +147,17 @@ class YubiKey():
         piv.change_puk('12345678', new_puk)
         piv.change_pin('123456', new_pin)
         writeStdout(Msg.YUBIKEY_PIN_SET_TO.format(new_pin))
-        piv.authenticate(MANAGEMENT_KEY_TYPE.TDES, DEFAULT_MANAGEMENT_KEY)
+        piv.authenticate(piv.management_key_type, DEFAULT_MANAGEMENT_KEY)
         piv.verify_pin(new_pin)
         writeStdout(Msg.YUBIKEY_GENERATING_NONEXPORTABLE_PRIVATE_KEY)
         pubkey = piv.generate_key(SLOT.AUTHENTICATION,
                                   KEY_TYPE.RSA2048,
                                   PIN_POLICY.ALWAYS,
                                   TOUCH_POLICY.NEVER)
-        now = arrow.utcnow()
-        valid_to = now.shift(days=36500)
+        now = datetime.utcnow()
+        valid_to = now + timedelta(days=3650)
         subject = 'CN=GAM Created Key'
-        piv.authenticate(MANAGEMENT_KEY_TYPE.TDES, DEFAULT_MANAGEMENT_KEY)
+        piv.authenticate(piv.management_key_type, DEFAULT_MANAGEMENT_KEY)
         piv.verify_pin(new_pin)
         cert = generate_self_signed_certificate(piv,
                                                 SLOT.AUTHENTICATION,

src/tools/ssd.mjs

@@ -9,7 +9,7 @@ import { TOTP } from 'totp-generator';
 
 async function screenshot(driver, filename) {
   // uncomment to save .png screenshots
-  //await driver.saveScreenshot(filename);
+  await driver.saveScreenshot(filename);
   return
 }
 

wiki/Authorization.md

@@ -30,8 +30,8 @@
   - [Update an existing Service Account key](#update-an-existing-service-account-key)
   - [Replace all existing Service Account keys](#replace-all-existing-service-account-keys)
   - [Delete Service Account keys](#delete-service-account-keys)
-  - [Upload a Service Account key to a service account with no keys](#upload-a-service-account-key-to-a-service-account-with-no-keys)
   - [Display Service Account keys](#display-service-account-keys)
+  - [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
 - [Manage Service Account access](#manage-service-account-access)
   - [Full Service Account access](#full-service-account-access)
   - [Selective Service Account access](#selective-service-account-access)
@@ -394,9 +394,9 @@ gam show projects [[admin] <EmailAddress>] [all|<ProjectIDEntity>]
 * `<EmailAddress>` - A Google Workspace admin/GCP project manager; if omitted, you will be prompted for the address
 
 Use these options to select projects.
-* `all` - All projects accessible by the administrator; this is the default
+* `all` - All projects accessible by the administrator
 * `current` - The project referenced in `client_secrets.json`
-* `gam` - Projects accessible by the administrator that were created by Gam, i.e, their project ID begins with `gam-project-`
+* `gam` - Projects accessible by the administrator that were created by Gam, i.e, their project ID begins with `gam-project-`; this is the default
 * `<ProjectID>` - A Google API project ID
 * `filter <String>` - A filter to select projects accessible by the administrator; see the API documentation
 * `states all|active|deleterequested` - Limit display to projects based on state; the default is `active`
@@ -412,9 +412,9 @@ gam print projects [[admin] <EmailAddress>] [all|<ProjectIDEntity>] [todrive <To
 * `<EmailAddress>` - A Google Workspace admin/GCP project manager; if omitted, you will be prompted for the address
 
 Use these options to select projects.
-* `all` - All projects accessible by the administrator; this is the default
+* `all` - All projects accessible by the administrator
 * `current` - The project referenced in `client_secrets.json`
-* `gam` - Projects accessible by the administrator that were created by Gam, i.e, their project ID begins with `gam-project-`
+* `gam` - Projects accessible by the administrator that were created by Gam, i.e, their project ID begins with `gam-project-`; this is the default
 * `<ProjectID>` - A Google API project ID
 * `filter <String>` - A filter to select projects accessible by the administrator; see the API documentation
 * `states all|active|deleterequested` - Limit display to projects based on state; the default is `active`
@@ -781,6 +781,14 @@ Here are some sample values:
 Create a new Service Account private key; all existing private keys remain valid.
 The `oauth2service.json` file is updated with the new private key.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 Keep a good record of where each Service Account key is used as the keys themselves do not record this information.
 
 The two forms of the command are equivalent; the second form is used by Legacy GAM.
@@ -809,6 +817,14 @@ The `oauth2service.json` file is updated with the new private key. If you had pr
 this `oauth2service.json` file to other users, you must redistribute the updated file as the private key
 in the distributed copies has been revoked.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 The two forms of the command are equivalent; the second form is used by Legacy GAM.
 ```
 gam update sakey
@@ -828,6 +844,14 @@ in the distributed copies has been revoked.
 
 This command can be used if your Service Account keys have been compromised; all existing private keys are revoked.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 The two forms of the command are equivalent; the second form is used by Legacy GAM.
 ```
 gam replace sakeys
@@ -844,25 +868,20 @@ You can delete Service Accounts keys thus revoking access for that key. Generall
 delete a service account key for a distributed copy of an `oauth2service.json` file to disable
 that user's service account access.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 You can disable your current Service Account key if you specify the `doit` argument. This is your
 acknowledgement that you will have to manually create a new Service Account key in the Developer's Console
 or upload a new key with the `gam upload sakey` command.
 ```
 gam delete sakeys <ServiceAccountKeyList>+ [doit]
 ```
-## Upload a Service Account key to a service account with no keys
-There are two cases where you will use this command:
-* Your workspace is configured to disable service account private key uploads and you are creating a project.
-* All of your service account keys have been deleted, either manually or with the `gam delete sakeys` command.
-
-The `oauth2service.json` file is updated with the new private key. If you had previously distributed
-any `oauth2service.json` file to other users, you must redistribute the updated file with the new key.
-```
-gam upload sakey [admin <EmailAddress>]
-        (algorithm KEY_ALG_RSA_1024|KEY_ALG_RSA_2048)|
-        (localkeysize 1024|2048|4096 [validityhours <Number>])|
-        (yubikey yubikey_pin yubikey_slot AUTHENTICATION|SIGNATURE yubikey_serialnumber <Number>)
-```
 ## Display Service Account keys
 There are system keys and user keys; user keys are what Gam uses; GCP uses system keys.
 
@@ -876,6 +895,19 @@ gam show sakeys [all|system|user]
 
 The private key currently being used in `oauth2service.json` will be marked as `usedToAuthenticateThisRequest: True`.
 
+## Upload a Service Account key to a service account without a valid private key
+There are two cases where you will use this command:
+* Your workspace is configured to disable service account private key uploads and you are creating a project.
+* All of your service account keys have been deleted, either manually or with the `gam delete sakeys` command.
+
+The `oauth2service.json` file is updated with the new private key. If you had previously distributed
+any `oauth2service.json` file to other users, you must redistribute the updated file with the new key.
+```
+gam upload sakey [admin <EmailAddress>]
+        (algorithm KEY_ALG_RSA_1024|KEY_ALG_RSA_2048)|
+        (localkeysize 1024|2048|4096 [validityhours <Number>])|
+        (yubikey yubikey_pin yubikey_slot AUTHENTICATION|SIGNATURE yubikey_serialnumber <Number>)
+```
 ## Manage Service Account access
 
 ## Full Service Account access

wiki/Basic-Items.md

@@ -283,6 +283,8 @@
 <ChatEmoji> ::= emojiname <ChatEmojiName> | customemojis/<String>
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMessage> ::= spaces/<String>/messages/<String>
+<ChatSection> ::= users/<String>/sections/<String> | sections/<String> | section <String>
+<ChatSectionItem> ::= users/<String>/sections/<String>/items/<String> | sections/<String>/items/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChromeProfilePermanentID> ::= <String>
@@ -409,6 +411,8 @@
 <MatterItem> ::= <UniqueID>|<String>
 <MatterState> ::= open|closed|deleted
 <MeetConferenceName> ::= conferenceRecords/<String>
+<MeetID> ::= <String>
+       Must match this Python Regular Expression: [a-z]{3}-[a-z]{4}-[a-z]{3}
 <MeetSpaceName> ::= spaces/<String> | <String>
 <MessageContent> ::=
         (message|textmessage|htmlmessage <String>)|
@@ -424,6 +428,7 @@
         (gdoc|ghtml <UserGoogleDoc>)|
         (gcsdoc|gcshtml <StorageBucketObjectName>)
 <NumberOfSeats> ::= <Number>
+<NumberRange> ::= <Number>|(<Number>/<Number>)
 <OrgUnitID> ::= id:<String>
 <OrgUnitPath> ::= /|(/<String>)+
 <OrgUnitItem> ::= <OrgUnitID>|<OrgUnitPath>
@@ -564,11 +569,11 @@
         (tdreturnidonly [<Boolean>])|
         (tdshare <EmailAddress> commenter|reader|writer)*|
         (tdsheet (id:<Number>)|<String>)|
-        (tdsheettimestamp [<Boolean>] [tdsheettimeformat <String>])
+        (tdsheettimestamp [<Boolean>] [tdsheettimeformat <DateTimeFormat>])
         (tdsheettitle <String>)|
         (tdsubject <String>)|
         ([tdsheetdaysoffset <Number>] [tdsheethoursoffset <Number>])|
-        (tdtimestamp [<Boolean>] [tdtimeformat <String>]
+        (tdtimestamp [<Boolean>] [tdtimeformat <DateTimeFormat>]
             [tddaysoffset <Number>] [tdhoursoffset <Number>])|
         (tdtimezone <TimeZone>)|
         (tdtitle <String>)|

wiki/Bulk-Processing.md

@@ -38,6 +38,7 @@ Batch files can contain the following types of lines:
 * Blank lines - Ignored
 * \# Comment line - Ignored
 * gam \<GAMArgumentList\> - Execute a GAM command 
+  * File path arguments in \<GAMArgumentList\> should be enclosed in \"
 * commit-batch
   * GAM waits for all running GAM commands to complete
   * GAM continues

wiki/Calendars-Events.md

@@ -78,6 +78,8 @@ Client access works when accessing Resource calendars.
         <CSVkmdSelector> | <CSVDataSelector>
         See: https://github.com/GAM-team/GAM/wiki/Collections-of-Items
 <iCalUID> ::= <String>
+<MeetID> ::= <String>
+       Must match this Python Regular Expression: [a-z]{3}-[a-z]{4}-[a-z]{3}
 
 <EventAttachmentsSubfieldName> ::=
         attachments.fileid|
@@ -150,7 +152,8 @@ Client access works when accessing Resource calendars.
         endtimeunspecified|
         extendedproperties|
         eventtype|
-        <EventFocusTimePropertiesSubfieldName>
+        focustimeproperties|
+        <EventFocusTimePropertiesSubfieldName>|
         gadget|
         guestscaninviteothers|
         guestscanmodify|
@@ -164,7 +167,8 @@ Client access works when accessing Resource calendars.
         organizer|
         <EventOrganizerSubfieldName>|
         originalstart|originalstarttime|
-        <EventOutOfOfficePropertiesSubfieldName>
+        outofofficeproperties|
+        <EventOutOfOfficePropertiesSubfieldName>|
         privatecopy|
         recurrence|
         recurringeventid|
@@ -254,6 +258,7 @@ Client access works when accessing Resource calendars.
         (birthday <Date>)|
         (color <EventColorName>)|
         (colorindex|colorid <EventColorIndex>)|
+        (conferencedata meet <MeetID>)|
         (description <String>)|
         (end|endtime (allday <Date>)|<Time>)|
         (guestscaninviteothers <Boolean>)|
@@ -261,7 +266,7 @@ Client access works when accessing Resource calendars.
         (guestscanmodify <Boolean>)|
         (guestscanseeotherguests <Boolean>)|
         guestscantseeotherguests|
-        hangoutsmeet|
+        googlemeet|hangoutsmeet|
         <JSONData>|
         (jsonattendees [charset <Charset>] <String>)|
         (jsonattendees file <FileName> [charset <Charset>])|
@@ -302,7 +307,7 @@ The following attributes are equivalent:
         <EventAttribute>|
         clearattachments|
         clearattendees|
-        clearhangoutsmeet|
+        cleargooglemeet|clearhangoutsmeet|
         (clearprivateproperty <PropertyKey>)|
         clearresources|
         (clearsharedproperty <PropertyKey>)|
@@ -511,11 +516,16 @@ Use `jsonattendees file ./attendees.json` in `create/update event`.
 
 ## Delete selected calendar events
 ```
-gam calendar <CalendarEntity> delete events [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam calendar <CalendarEntity> purge events [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam calendar <CalendarEntity> delete events [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam calendar <CalendarEntity> purge events [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 ```
 If `<EventEntity>` is not specified, all events in `<CalendarEntity>` are selected. This is not typically used.
 
+By default, each event is deleted in a separate API call, use `batchsize` with an integer between 1 and 1000
+to delete the events in batches.
+
 No events are deleted unless you specify the `doit` option; omit `doit` to verify that you properly selected the events to delete.
 
 When events are deleted from a calendar, they are moved to the calendar's trash and are only permanently deleted (purged) after 30 days.
@@ -585,7 +595,7 @@ By default, Gam displays event details, use `countsonly` to display only the num
 
 ```
 gam calendar <CalendarEntity> print events [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         (addcsvdata <FieldName> <String>)*
         [eventrowfilter]
         [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
@@ -599,6 +609,10 @@ option `singleevents` to display all instances of a recurring event.
 
 `showdayofweek` displays columns `start.dayOfWeek` and `end.dayOfWeek` when event start and end times are displayed.
 
+By default, each attendee is displayed in a separate column; `attendeeslist` causes GAM to display
+the attendee email addresses in a single column `attendeesList`; no attendee details are displayed.
+The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
 Add additional columns of data from the command line to the output after the calendarId.
 * `addcsvdata <FieldName> <String>`
 

wiki/Calendars.md

@@ -27,13 +27,16 @@ Client access works when accessing Resource calendars.
         See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 
 <CalendarSettings> ::=
+        (autoacceptinvitations [<Boolean>])|
         (description <String>)|
         (location <String>)|
         (summary <String>)|
         (timezone <TimeZone>)
 
 <CalendarSettingsField> ::=
+        autoacceptinvitations|3
         conferenceproperties|
+        dataowner|
         description|
         id|
         location|

wiki/Chrome-Device-Counts.md

@@ -1,6 +1,8 @@
 # Chrome Device Counts
 - [API documentation](#api-documentation)
+- [Notes](#notes)
 - [Definitions](#definitions)
+- [Count titles](#count-titles)
 - [Display Chrome device counts](#display-chrome-device-counts)
 
 ## API documentation
@@ -24,29 +26,34 @@ gam oauth create
         today
 ```
 
+## Count titles
+`active` - `sevenDaysCount,thirtyDaysCount`
+`perboottype` - `devBootTypeCount,unreportedBootTypeCount,verifiedBootTypeCount`
+`perreleasechanneel` - `betaChannelCount,canaryChannelCount,devChannelCount,ltcChannelCount,ltsChannelCount,stableChannelCount,unreportedChannelCount,unsupportedChannelCount`
+
 ## Display Chrome device counts
 ```
 gam show chromedevicecounts
-        [mode active|perboottype|perreleasechannel]
+        (mode all|active|perboottype|perreleasechannel)*
         [date <Date>]
         [formatjson]
 ```
-By default, `mode` is `active`.
+By default, `mode all` is selected
 
-By default, `date <Date>` is `date today`.
+By default, `date today` is selected.
 
 By default, Gam displays the information as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
 
 ```
 gam print chromedevicecounts [todrive <ToDriveAttribute>*]
-        [mode active|perboottype|perreleasechannel]
+        (mode all|active|perboottype|perreleasechannel)*
         [date <Date>]
         [formatjson [quotechar <Character>]]
 ```
-By default, `mode` is `active`.
+By default, `mode all` is selected
 
-By default, `date <Date>` is `date today`.
+By default, `date today` is selected.
 
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.

wiki/Chrome-Installed-Apps.md

@@ -1,9 +1,9 @@
-# Chrome Installed Apps Counts
+# Chrome Installed Apps
 - [API documentation](#api-documentation)
 - [Definitions](#definitions)
 - [Quoting rules](#quoting-rules)
 - [Display Chrome installed app details](#display-chrome-installed-app-details)
-- [Display Chrome installed apps counts](#display-chrome-installed-apps-counts)
+- [Display Chrome installed apps](#display-chrome-installed-apps)
 - [Display Chrome devices with a specific installed application](#display-chrome-devices-with-a-specific-installed-application)
 
 ## API documentation
@@ -54,7 +54,7 @@ gam info chromeapp android|chrome|web <AppID>
 By default, Gam displays the information as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
 
-## Display Chrome installed apps counts
+## Display Chrome installed apps
 ```
 gam show chromeapps
         [(ou <OrgUnitItem>)|(ou_and_children <OrgUnitItem>)|

wiki/Chrome-Policies.md

@@ -9,6 +9,7 @@
 - [Create a Chrome policy image](#create-a-chrome-policy-image)
 - [Update Chrome policy](#update-chrome-policy)
 - [Delete Chrome policy](#delete-chrome-policy)
+- [Delete Chrome app](#delete-chrome-app)
 - [Display Chrome policies](#display-chrome-policies)
 - [Copy simple policies set directly in one OU to another OU](#copy-simple-policies-set-directly-in-one-ou-to-another-ou)
 - [Copy simple and complex policies set directly in one OU to another OU](#copy-simple-and-complex-policies-set-directly-in-one-ou-to-another-ou)
@@ -228,6 +229,17 @@ Restrict students from accessing Blocked URLs.
 ```
 gam update chromepolicy chrome.users.UrlBlocking urlBlocklist "https://socialmedia.com,https://videowebsite.com" orgunit "/Students"
 ```
+The Policy API and GAM have no ability to edit lists, you have to supply the complete list.
+```
+# Get the current policy
+gam redirect stdout ./urlBlockList.json show chromepolicies filter chrome.users.UrlBlocking orgunit "/Students" formatjson
+
+# Edit urlBlockList.json to add the new URL(s)
+{"additionalTargetKeys": [], "direct": true, "fields": [{"name": "urlBlocklist", "value": "https://socialmedia.com,https://videowebsite.com,https://nogo.com"}, {"name": "chromeInternalUrlsBlocked", "value": false}], "name": "chrome.users.UrlBlocking", "orgUnitPath": "/Students", "parentOrgUnitPath": "/"}
+
+# Update the policy
+gam update chromepolicies chrome.users.UrlBlocking json file urlBlockList.json orgunit "/Students"
+```
 For managed browsers, specify that users can only sign into managed accounts belonging to company/school domains.
 ```
 gam update chromepolicy chrome.users.SecondaryGoogleAccountSignin allowedDomainsForApps company.com,company.net orgunit "/Managed Browsers"
@@ -243,7 +255,6 @@ Allowlist the Google Translate extension for the Students OrgUnit
 ```
 gam update chromepolicy chrome.users.apps.InstallType appInstallType ALLOWED app_id chrome:aapbdbdomjkkjkaonfhkkikfgjllcleb ou "/Students"
 ```
-
 ## Delete Chrome policy
 You can delete a policy for all devices/users within an OU, users with a group or for a specific printer or application within an OU.
 
@@ -255,6 +266,13 @@ gam delete chromepolicy
         ((ou|orgunit <OrgUnitItem>)|(group <GroupItem>))
         [(printerid <PrinterID>)|(appid <AppID>)]
 ```
+
+## Delete Chrome app
+You can  delete an app, i.e., explicitly remove it from management. `<OrgUnitItem>` must specify where the app was added for management.
+```
+gam delete chromepolicy chrome.users.apps.InstallType ou|orgunit <OrgUnitItem> appid <AppID>
+```
+
 ## Display Chrome policies
 You can display policies for all devices/users within an OU, users with a group or for a specific printer or application within an OU.
 

wiki/ChromeOS-Devices.md

@@ -14,6 +14,7 @@
 - [Action ChromeOS devices](#action-chromeos-devices)
 - [Send remote commands to ChromeOS devices](#send-remote-commands-to-chromeos-devices)
   - [Action Examples](#action-examples)
+  - [Bulk Action Example](#bulk-action-example)
 - [ChromeOS device lists](#chromeos-device-lists)
 - [Display information about ChromeOS devices](#display-information-about-chromeos-devices)
 - [Print ChromeOS devices](#print-chromeos-devices)
@@ -445,12 +446,19 @@ is configurable from 0 to some large number. If the status reaches `EXPIRED`, `C
         wipe_users|
         take_a_screenshot
 
-gam <CrOSTypeEntity> issuecommand command <CrOSCommand> [times_to_check_status <Integer>] [doit]
+gam <CrOSTypeEntity> issuecommand command <CrOSCommand>
+        [times_to_check_status <Integer>] [csv] [doit]
 ```
+By default, when a Chrome command is issued, GAM outputs details of the command status as indented keywords and values.
+* `csv` - Output the details in CSV format.
+
 If the final status is not reached before GAM exits, you can issue the following commands to continue checking the status.
 ```
-gam <CrOSTypeEntity> getcommand commandid <CommandID> [times_to_check_status <Integer>]
+gam <CrOSTypeEntity> getcommand commandid <CommandID>
+        [times_to_check_status <Integer>] [csv]
 ```
+By default, when a Chrome command status is read, GAM outputs details of the command status as indented keywords and values.
+* `csv` - Output the details in CSV format.
 
 ### Action Examples
 Remove user profile data from the device; the device will remain enrolled and connected.
@@ -476,6 +484,40 @@ Use `wipe_users` if that's going to create too much work for you.
 ```
 gam cros_ou /StudentCarts issuecommand command remote_powerwash times_to_check_status 0 doit
 ```
+
+### Bulk Action example
+You want to issue commands to many ChromeOS devices and monitor the results.
+
+Assume a Google Sheet with two tabs: Commands and Results
+The Commands tab has at least two columns: serialNumber and command
+```
+serialNumber,command
+abc123def123,reboot
+abc123def456,remote_powerwash
+abc123def789,wipe_users
+```
+Here is the URL for the Commands tab
+```
+https://docs.google.com/spreadsheets/d/12349lNWvZwzJhwxyz/edit?gid=1588227640#gid=1588227640
+<SheetFileID> = 12349lNWvZwzJhwxyz
+<CommandTabID> = 1588227640
+Here is the URL for the Commands tab
+https://docs.google.com/spreadsheets/d/12349lNWvZwzJhwxyz/edit?gid=2102420937#gid=2102420937
+<SheetFileID> = 12349lNWvZwzJhwxyz
+<ResultsTabID> = 2102420937
+```
+Replace `user@domain.com` with the email address of the Google Sheet owner.
+
+Issue the commands from the Commands tab and write the results to the Results tab; copy the `serialNumber` to the Results tab.
+```
+gam config num_threads 20 redirect csv - multiprocess sortheaders serialNumber todrive tduser user@domain.com tdfileID <SheetFileID> tdsheet id:<ResultsTabID> tdupdatesheet tdretaintitle redirect stderr - multiprocess csv gsheet user@domain.com <SheetFileID> id:<CommandsTabID> gam cros_sn "~serialNumber" issuecommand command "~command" doit csv addcsvdata serialNumber "~serialNumber"
+```
+Monitor the results by reading and updating the results from/to the Results tab; copy the `serialNumber` to the Results tab.
+```
+gam config num_threads 20 redirect csv - multiprocess sortheaders serialNumber todrive tduser user@domain.com tdfileID <SheetFileID> tdsheet id:<ResultsTabID> tdupdatesheet tdretaintitle redirect stderr - multiprocess csv gsheet user@domain.com <SheetFileID> id:<ResultsTabID> gam cros "~deviceId" getcommand commandid "~commandId" csv addcsvdata serialNumber "~serialNumber"
+```
+You can use additional `addcsvdata` options to copy device identifying information from the source to the destination.
+
 ## ChromeOS device lists
 ChromeOS devices have lists of data: `<CrOSListFieldName>`, `<CrOSActivityListFieldName>`, `<CrOSTelemetryListFieldName>`.
 All lists except `recentusers` are in ascending order (oldest to newest). As these lists can contain many entries,
@@ -544,7 +586,7 @@ gam print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 ```
@@ -591,9 +633,11 @@ Add additional columns of data from the command line to the output
 * `addcsvdata <FieldName> <String>`
 
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
-
 - `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
@@ -612,7 +656,7 @@ gam <CrOSTypeEntity> print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 
@@ -623,6 +667,7 @@ gam print cros [todrive <ToDriveAttribute>*] select <CrOSTypeEntity>
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 ```
@@ -645,9 +690,11 @@ Add additional columns of data from the command line to the output
 * `addcsvdata <FieldName> <String>`
 
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
-
 - `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Classroom-Courses.md

@@ -379,7 +379,7 @@ Drive files with `shareMode` `Each student will get a copy` don't seem to be abl
 
 ## Delete courses
 Classes can only be deleted when they are in the ARCHIVED state; to delete a class, you can update its state to ARCHIVED
-and then delete it or you can specify that it be archived as parot of the delete command.
+and then delete it or you can specify that it be archived as part of the delete command.
 ```
 gam delete course <CourseID> [archived]
 gam delete courses <CourseEntity> [archived]

wiki/Classroom-Membership.md

@@ -7,6 +7,7 @@
 - [Bulk membership changes](#bulk-membership-changes)
 - [Display course membership](#display-course-membership)
 - [Display course membership counts](#display-course-membership-counts)
+- [Display course counts for teachers-students](#display-course-counts-for-teachers-students)
 
 ## API documentation
 * [Google Classroom API](https://developers.google.com/classroom/reference/rest)
@@ -167,3 +168,46 @@ $count = & gam print course-participants teacher asmith states active show stude
 Windows Command Prompt
 for /f "delims=" %a in ('gam print course-participants teacher asmith states active show students showitemcountonly') do set count=%a
 ```
+
+## Display course counts for teachers-students
+You can get a count of the number of courses in which a teacher or student is a participant.
+```
+gam print course-counts students|teachers [todrive <ToDriveAttribute>*]
+        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
+        [mincount <Integer>]
+        [formatjson [quotechar <Character>]]
+```
+By default, the `print course-counts` command displays participant counts about all courses.
+
+To get participant counts for a specific set of courses, use the following option; it can be repeated to select multiple courses.
+* `(course|class <CourseID>)*` - Display courses with the specified `<CourseID>`.
+
+To get participant counts for courses based on their having a particular participant, use the following options. Both options can be specified.
+* `teacher <UserItem>` - Display courses with the specified teacher.
+* `student <UserItem>` - Display courses with the specified student.
+
+To get participant counts for courses based on their state, use the following option. This option can be combined with the `teacher` and `student` options.
+By default, all course states are selected.
+* `states <CourseStateList>` - Display courses with any of the specified states.
+
+By default, all count values are displayed, use `mincount <Integer>` to limit the display to those counts
+greater that or equal to the specified `<Integer>`.
+
+By default, Gam displays the counts as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+### Example
+For teachers in all active courses, print the number of classes for which they are a participant.
+```
+gam print coursecounts teachers states active
+```
+For teachers in all active courses, print the number of classes (if it is >= 5) for which they are a participant.
+```
+gam print coursecounts teachers states active mincount 5
+```

wiki/Cloud-Identity-Devices.md

@@ -40,6 +40,18 @@ Use `gam user user@domain.com update serviceaccount` and make sure that the foll
 * [Filters](https://support.google.com/a/answer/7549103)
 * [Device Search Fields](https://developers.google.com/admin-sdk/directory/v1/search-operators)
 
+Use this table to filter/query for specific device types:
+| Device Type | Filter/Query |
+|-------------|--------------|
+| ANDROID | type:android |
+| CHROME_OS | type:chromeos |
+| GOOGLE_SYNC | type:googlesync |
+| IOS | type:ios |
+| LINUX | type:linux |
+| MAC_OS | type:mac |
+| WINDOWS | type:windows |
+
+
 ## Definitions
 ```
 <AssetTag> ::= <String>
@@ -370,7 +382,6 @@ Windows Command Prompt
 for /f "delims=" %a in ('gam print deviceusers queries "'model:Mac'" showitemcountonly') do set count=%a
 ```
 
-
 ## Display device user client state
 ```
 gam info deviceuserstate <DeviceUserEntity> [clientid <String>] 
@@ -379,11 +390,11 @@ gam info deviceuserstate <DeviceUserEntity> [clientid <String>]
 ## Update device user client state
 The API that supports this command is in beta mode. In particular, setting `assettags` and `customvalues`
 works if you set the values once; each additional time you set values they are added to the existing values
-and they is no way at the moment to clear values.
+and the `clear` option does not work to clear values.
 ```
 gam update deviceuserstate <DeviceUserEntity> [clientid <String>] 
         [customid <String>] [assettags clear|<AssetTagList>]
         [compliantstate|compliancestate compliant|noncompliant] [managedstate clear|managed|unmanaged]
         [healthscore very_poor|poor|neutral|good|very_good] [scorereason clear|<String>]
-        (customvalue (bool|boolean <Boolean>)|(number <Integer>)|(string <String>))*
+        (customvalue clear|(bool|boolean <String> <Boolean>)|(number <String> <Integer>)|(string <String> <String>))*
 ```

wiki/Cloud-Identity-Groups-Membership.md

@@ -13,7 +13,7 @@
 - [Display user group member options](#display-user-group-member-options)
 - [Display group membership in CSV format](#display-group-membership-in-csv-format)
 - [Display group membership in hierarchical format](#display-group-membership-in-hierarchical-format)
-
+- [Display external users in groups with allowExternalMembers False](#display-external-users-in-groups-with-allowexternalmembers-false)
 ## API documentation
 * [Cloud Identity Groups Overview](https://cloud.google.com/identity/docs/groups)
 * [Cloud Identity Groups API - Groups](https://cloud.google.com/identity/docs/reference/rest/v1/groups)
@@ -349,11 +349,15 @@ gam print cigroup-members [todrive <ToDriveAttribute>*]
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
+        [verifyallowexternal [<Boolean>]]
         [types <CIGroupMemberTypeList>]
         <CIGroupMembersFieldName>* [fields <CIGroupMembersFieldNameList>]
         [minimal|basic|full]
         [(recursive [noduplicates]) | |includederivedmembership] [nogroupeemail]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
+        (addcsvdata <FieldName> <String>)*
+        [formatjson [quotechar <Character>]]
 ```
 By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
 * `cimember <UserItem>` - Limit display to groups that contain `<UserItem>` as a member
@@ -378,6 +382,24 @@ By default, all members, managers and owners in the group are displayed; these o
 By default, all types of members (cbcmbrowser, chromeosdevice, customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group and adds the column `category` that shows whether the member
+is `external` or `internal`.
+
+The option `verifyallowexternal` causes GAM to only display `external` users in groups with `allowExternalMembers=False'.
+
 By default, members that are groups are displayed as a single entry of type GROUP; this option recursively expands group members to display their user members.
 * `recursive` - Recursively expand group members
 
@@ -414,6 +436,9 @@ has in any constituent group, it is not necessarily its role in the top group.
 The options `recursive noduplicates` and `includederivedmembership types user` return the same list of users.
 The `includederivedmembership` option makes less API calls but doesn't show level and subgroup information.
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
@@ -430,9 +455,10 @@ gam show cigroup-members
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
-        [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [minimal|basic|full]
+        [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [(depth <Number>) | includederivedmembership]
 ```
 By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -458,6 +484,18 @@ By default, all members, managers and owners in the group are displayed; these o
 By default, all types of members (cbcmbrowser, chromeosdevice, customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
+
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
 * `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
@@ -495,3 +533,7 @@ To show the structure of all groups you can do the following; it will be time co
 ```
 gam redirect stdout ./groups.txt show cigroup-members types group
 ```
+
+## Display external users in groups with allowExternalMembers False
+When printing  group membership, the option `verifyallowexternal` causes
+GAM to only display external users in groups with `allowExternalMembers=False`.

wiki/Cloud-Identity-Groups.md

@@ -267,7 +267,7 @@ gam info cigroups <GroupEntity>
         [nosecurity|nosecuritysettings]
         [allfields|<CIGroupFieldName>*|(fields <CIGroupFieldNameList>)]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [formatjson]
@@ -283,13 +283,17 @@ By default, all direct members, managers and owners in the group are displayed;
 By default, when displaying members from a group, all types of members (customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
@@ -317,11 +321,12 @@ gam print cigroups [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [basic|allfields|(<CIGroupFieldName>* [fields <CIGroupFieldNameList>])]
         [roles <GroupRoleList>] [memberrestrictions]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 ```
 By default, all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -373,21 +378,34 @@ By default, no members, managers or owners in the group are displayed; these opt
 By default, when displaying members from a group, all types of members (customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group.
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
 * `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Domain-SharedContacts.md

@@ -29,11 +29,11 @@
 <UserGoogleDoc> ::=
         <EmailAddress> <DriveFileIDEntity>|<DriveFileNameEntity>|(<SharedDriveEntity> <SharedDriveFileNameEntity>)
 
-<NoteContent> ::=
-        ((<String>)|
-         (file <FileName> [charset <Charset>])|
-         (gdoc <UserGoogleDoc>)|
-         (gcsdoc <StorageBucketObjectName>))
+<ContactNoteContent> ::=
+        (<String>)|
+        (file|textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)|
+        (gcsdoc <StorageBucketObjectName>)
 
 <Date> ::=
         <Year>-<Month>-<Day> |
@@ -79,7 +79,7 @@
         (mileage <String>)|
         (name <String>)|
         (nickname <String>)|
-        (note <NoteContent>)|
+        (note <ContactNoteContent>)|
         (occupation <String>)|
         (prefix <String>)|
         (priority low|normal|high)

wiki/GAM7-on-Android-Devices.md

@@ -13,4 +13,4 @@ _Note: Chromebooks / Chrome OS devices should install GAM7 using [these instruct
     sudo apt update
     sudo apt install curl python3
 ```
-7. [How to Install Advanced GAM](How-to-Install-Advanced-GAM)
+7. [How to Install GAM7](How-to-Install-GAM7)

wiki/GAM7-on-Chrome-OS-Devices.md

@@ -7,7 +7,7 @@ Chrome OS devices that [support Linux apps](https://support.google.com/chromeboo
     sudo apt update
     sudo apt install xz-utils
 ```
-3. [How to Install Advanced GAM](How-to-Install-Advanced-GAM)
+3. [How to Install GAM7](How-to-Install-GAM7)
 
 # Google cloud shell
 

wiki/GamUpdates.md

@@ -10,6 +10,301 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.32.02
+
+Added variable `oauth2_txt_lock_mode` to `gam.cfg`, the default is 644 and valid values are: 644, 664, 666.
+This value is used to set the file permissions on the `oauth2.txt.lock` file. In very special cases where
+daemon processes, e.g. Apache/httpd, are running GAM, the value 666 may have to be used.
+
+### 7.32.01
+
+Added option `(addcsvdata <FieldName> <String>)*` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand> csv`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID> csv` that adds additional columns of data to the CSV file output.
+* See: https://github.com/GAM-team/GAM/wiki/ChromeOS-Devices#bulk-action-example
+
+### 7.32.00
+
+Added option `verifyallowexternal` to `gam print cigroup-members|group-members` that causes
+GAM to only display external members in groups with `allowExternalMembers=False'.
+This option can be used to help verify that internal-only groups don't have external members.
+
+Updated option `internaldomains` for the following commands:
+```
+gam info|print groups
+gam print|show group-members
+gam info|print cigroups
+gam print|show cigroup-members
+gam <UserTypeEntity> print|show filesharecounts
+```
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+Added option `csv` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand>`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID>` so that command details are displayed in CSV format.
+This can be used to log commands issued to devices and then monitor the results.
+
+Added option `filemimetype category <MimeTypeNameList>` to `gam <UserTypeEntity> copy drivefile` to support
+copying of files based on their MimeType category.
+
+Added option `attendeeslist` to `gam calendars <CalendarEntity> print events` and `gam <UserTypeEntity> print events`
+that causes GAM to display the attendee email addresses in a single column `attendeesList`; no attendee details
+are displayed. The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
+Fixed bug in `gam sendemail ... replyto <EmailAddress>` that caused a message delivery error if
+`<EmailAddress>` did not include a domain name.
+
+Added support for users's chat sections.
+* See: https://github.com/GAM-team/GAM/wiki/Users-Chat#manage-chat-users-sections
+* This is in Deveoper Preview; you must have a `developer_preview_api_key` in `gam.cfg` to use these commands.
+
+### 7.31.06
+
+Added option `batchsize <Integer>` to `gam calendar <CalendarEntity> delete|purge events` and
+`gam <UserTypeEntity> delete|purge events <UserCalendarEntity>` that causes GAM to delete events
+with batch API calls rather than with individual API calls.
+
+### 7.31.05
+
+Added option `variables <RESearchPattern>` to `gam select section <SectionName> verify` and `gam config verify`
+that causes GAM to only display variables with names selected by `<RESearchPattern>`.
+```
+gam select School verify variables "^(customer|domain)"
+Section: School
+  customer_id = C03abc123
+  domain = school.edu
+
+gam config verify variables  'dir'
+Section: DEFAULT
+  cache_dir = ~/GamConfig/gamcache ; /Users/gamteam/GamConfig/gamcache
+  config_dir = ~/GamConfig ; /Users/gamteam/GamConfig
+  drive_dir = ~/GamWork ; /Users/gamteam/GamWork
+  gmail_cse_incert_dir = ~/GmailCSE/Certs ; /Users/gamteam/GmailCSE/Certs
+  gmail_cse_inkey_dir = ~/GmailCSE/Keys ; /Users/gamteam/GmailCSE/Keys
+  input_dir = .
+```
+
+### 7.31.04
+
+Fixed bug in `gam report admin|chrome` that caused to events to not be displayed.
+
+Updated `gam <UserTypeEntity> print|show messages|threads ... query <QueryGmail>` to display the query.
+
+### 7.31.03
+
+Due to the following Calendar API update, the `gam <UserTypeEntity> transfer calendars` command has been removed.
+* See: https://developers.google.com/workspace/calendar/release-notes#October_27_2025
+Data ownership can be transferred in the Google Calendar UI.
+
+### 7.31.02
+
+Added the following options to `gam <UserTypeEntity> copy drivefile`
+to limit copying to those files owned by selected users.
+* `copysubfilesownedby users <EmailAddressList>` - Only files owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby notusers <EmailAddressList>` - Only files not owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby regex <REMatchPattern>` - Only files owned by users whose email addresses match `<REMatchPattern>` are copied.
+* `copysubfilesownedby notregex <REMatchPattern>` - Only files owned by users whose email addresses do not match `<REMatchPattern>` are copied.
+
+### 7.31.01
+
+Code cleanup for `addcsvdata <FieldName> <String>`.
+
+### 7.31.00
+
+Fixed bug in `gam report chrome (user <UserItem>)|(select <UserTypeEntity>)` where no activities were returned.
+`report chrome` does not use the parameter `userKey=<EmailAddress>` as do other applications but requires
+parameter `filter DEVICE_USER==<EmailAddress>`.
+
+Updated `gam report admin (user <UserItem>)|(select <UserTypeEntity>)` to use parameter `filter USER_EMAIL==<EmailAddress>`
+to display activiities affecting the user `<EmailAddress>`. Use option `userisactor` to use the parameter `userKey=<EmailAddress>`
+that displays activities where user `<EmailAddress>` executed the command that generated the activity.
+
+Fixed bug in `gam print cros|filelist|users ... (addcsvdata <FieldName> <String>)+ formatjson` where the `addcsvdata` columns
+were not displayed but the additional field values were included in the JSON data. Now, the `addcsvdata` columns
+are displayed but the additional field values are only included in the JSON data when option `includdecsvdatainjson` is specified.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroups|groups`
+that adds additional columns of data to the CSV file output.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroupmembere|group-members`
+that adds additional columns of data to the CSV file output.
+
+### 7.30.05
+
+Added option `gmaileventtypes <NumberRangeList>` to `gam report gmail` that can be used to limit the event types displayed.
+```
+<NumberRange> ::= <Number>|(<Number>/<Number>)
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
+
+gam report gmail user user@domain.com gmaileventtypes 1,10/11
+```
+* See: https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gmail
+
+Updated sorting of column headers in `gam report <ActivityApplicationName>`.
+
+### 7.30.04
+
+Updated `gam report gmail` to avoid the following error when incomplete start/end time information is provided.
+```
+ERROR: Invalid request: Start time and end time should both be provided, and the scan duration should not be greater than 30 days.
+```
+* No time information provided - GAM sets `range -30d today`
+* Only `start <Time>`  provided - GAM sets `end <Time>+30d`
+* Only `end <Time>` provided - GAM sets `start <Time>-30d`
+
+### 7.30.03
+
+Updated `gam report <ActivityApplicationName>` to reflect the changes described here:
+* See: https://workspaceupdates.googleblog.com/2025/12/google-workspace-audit-log-api.html
+
+Added option `resourcedetailsfilter <String>` to `gam report <ActivityApplicationName>` described here:
+* See: https://developers.google.com/workspace/admin/reports/reference/rest/v1/activities/list#query-parameters
+
+For `gam <UserTypeEntity> print <Objects>`, expanded the list of `<Objects>` covered by `gam.cfg csv_output_users_audit = True`.
+
+### 7.30.02
+
+Added option `conferencedata meet <MeetID>` to `<EventAttribute>` that allows specifying
+a reference to an existing Google Meet when creating/updating a calendar event.
+
+Upgraded to Python 3.14.2.
+
+### 7.30.01
+
+Fixed bug introduced in 7.30.00 that caused errors when reading CSV files.
+
+Added the following options to `gam <UserTypeEntity> create focustime|outofoffice`:
+```
+((date yyyy-mm-dd)|
+ (range yyyy-mm-dd yyyy-mm-dd)|
+ (daily yyyy-mm-dd N)|
+ (weekly yyyy-mm-dd N))
+```
+
+Added the following options to `gam <UserTypeEntity> create focustime|outofoffice|workinglocation`:
+```
+noreminders|(reminder email|popup <Number>)+
+```
+
+### 7.30.00
+
+Added `input_dir` directory variable to `gam.cfg` that is used to select a directory for reading files with non-absolute file names.
+The default is an empty string that matches the current behavior where these files are read from the current working directory.
+This will be most useful in multiple domain situations where each domain will have distinct `drive_dir` and `input_dir` values.
+
+Added support for the new resource calendar setting `autoAcceptInvitations`.
+
+### 7.29.04
+
+Updated `gam delete chromepolicy chrome.users.apps.InstallType ou <OrgUnitItem> appid <AppID>`
+to allow deleting an app, i.e., explicitly remove it from management. `<OrgUnitItem>` must specify where it was added for management.
+
+### 7.29.03
+
+Remove debugging message from `gam <UserTypeEntity> move drivefile <DriveFileEntity>`.
+
+### 7.29.02
+
+Fixed bug in `gam <UserTypeEntity> move drivefile <DriveFileEntity>` where the following options
+were only applied to top level files or folders re-created in the destination. Now, domain
+and email address mappings apply to all moved files/folders.
+```
+excludepermissionsfromdomains <DomainNameList>
+includepermissionsfromdomains <DomainNameList>
+mappermissionsdomain <DomainName> <DomainName>
+mappermissionsemail <EmailAddress> <EmailAddress>
+mappermissionsemailfile <CSVFileInput> endcsv
+```
+
+Upgraded to Python 3.14.1.
+
+### 7.29.01
+
+Added option `oneitemperrow` to `gam <UserTypeEntity> print calendars ... permissions` to have each of a
+calendar's permissions displayed on a separate row with all of the other calendar fields.
+
+Updated `gam yubikey reset_piv` to handle YubiKey firmware updates that caused an error.
+
+### 7.29.00
+
+Added options `mappermissionsemail <EmailAddress> <EmailAddress>` and ` mappermissionsemailfile <CSVFileInput> endcsv`
+to these commands:
+```
+gam [<UserTypeEntity>] copy shareddriveacls <SharedDriveEntity> to <SharedDriveEntity>
+gam [<UserTypeEntity>] sync shareddriveacls <SharedDriveEntity> with <SharedDriveEntity>
+gam <UserTypeEntity> copy drivefile <DriveFileEntity>
+gam <UserTypeEntity> move drivefile <DriveFileEntity>
+```
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>`
+in the source will be modified to reference the second `<EmailAddress>` in the destination.
+
+Bulk permission email address mapping can be specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
+These options will be most useful with inter-workspace Shared Drive copies and moves.
+
+### 7.28.13
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print messages`
+that adds additional columns of data to the CSV file output.
+
+### 7.28.12
+
+Updated `gam delete project` to handle the following error:
+```
+ERROR: 400: failedPrecondition - Project not active
+```
+
+### 7.28.11
+
+Removed all options/fields referencing inheritance from `gam create|update|info|print org` as this option/field is deprecated.
+
+### 7.28.10
+
+Added a command `gam print course-counts` that dsplays the count of the number of courses in which a teacher or student is a participant.
+
+* See: https://github.com/GAM-team/GAM/wiki/Classroom-Membership#display-course-counts-for-teachers-students
+
+### 7.28.09
+
+Fixed bug in `gam print cigroups ... descriptionmatchpattern [not] <REMatchPattern>` that caused a trap.
+
+### 7.28.08
+
+Updated `gam <UserTypeEntity> print|show chatmessages` to cache the sender UID to email address
+map so that each sender UID only has to be looked up once; this improves performance.
+
+### 7.28.07
+
+Fixed bug in `gam report users ... aggregatebydate|aggregatebyuser` where `accounts:used_quota_in_percentage` was incorrectly displayed.
+
+### 7.28.06
+
+Updated	`gam <UserTypeEntity> info|print|show calendars` and
+`gam calendars <CalendarEntity> print|show settings` to display the
+new `dataOwner` field as described under `Additional details` below.
+
+* See: https://workspaceupdates.googleblog.com/2025/11/secondary-calendar-management-with-dedicated-owners.html
+
+### 7.28.04
+
+Updated commands that display Chrome device counts to display the date in the output.
+
+* See: https://github.com/GAM-team/GAM/wiki/Chrome-Device-Counts
+
+### 7.28.03
+
+Improved commands to display Chrome device counts.
+
+* See: https://github.com/GAM-team/GAM/wiki/Chrome-Device-Counts
+
+### 7.28.02
+
+Added commands to display Chrome device counts.
+
+* See: https://github.com/GAM-team/GAM/wiki/Chrome-Device-Counts
+
 ### 7.28.01
 
 Updated `gam <UserTypeEntity> show fileinfo <DriveFileEntity>` to display `displayName` as the key field
@@ -2679,7 +2974,7 @@ Added option `showmimetype category <MimeTypeNameList>` to `gam <UserTypeEntity>
 <MimeTypeName> ::= application|audio|font|image|message|model|multipart|text|video
 <MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
 
-gam user user@domain.com print filelist fields id,name,mimetype showmimetype prefixes audio,video
+gam user user@domain.com print filelist fields id,name,mimetype showmimetype category audio,video
 ```
 
 ### 6.71.11

wiki/Groups-Membership.md

@@ -615,7 +615,7 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [membernames] [showdeliverysettings]
         <MembersFieldName>* [fields <MembersFieldNameList>]
         [notsuspended|suspended] [notarchived|archived]
@@ -626,6 +626,7 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [(recursive [noduplicates])|includederivedmembership] [nogroupemail]
         [peoplelookup|(peoplelookupuser <EmailAddress>)]
         [unknownname <String>] [cachememberinfo [Boolean]]
+        (addcsvdata <FieldName> <String>)*
         [formatjson [quotechar <Character>]]
 ```
 By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -681,13 +682,21 @@ By default, when displaying members from a group, all members, whether suspended
 * `notsuspended archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
 * `suspended notarchived` - Only include suspended members, this is not common but allows creating groups that allow easy identification of suspended users
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group and adds the column `category` that shows whether the member
+is `external` or `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
@@ -733,6 +742,9 @@ The options `recursive noduplicates` and `includederivedmembership types user no
 The `includederivedmembership` option makes less API calls but doesn't show level and subgroup information.
 Expanding a member of type CUSTOMER may produce a large volume of data as it will display all users in your domain.
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
@@ -752,7 +764,7 @@ gam show group-members
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners] [depth <Number>]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -805,232 +817,17 @@ By default, when displaying members from a group, all members, whether suspended
 By default, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
 * `types <GroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
-
-Members that have met the above qualifications to be displayed can be further qualifed by their email address.
-* `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
-* `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
-
-By default, members of type GROUP are recursively expanded to show their constituent members. (Members of
-type CUSTOMER are not expanded.) The `depth <Number>` argument controls the depth to which nested groups are displayed.
-* `depth -1` - all groups in the selected group and below are displayed; this is the default.
-* `depth 0` - the groups within a selected group are displayed, no descendants are displayed.
-* `depth N` - the groups within the selected group and those groups N levels below the selected group are displayed.
-
-The `includederivedmembership` option causes the API to expand type GROUP and type CUSTOMER
-members to display their constituent members while still displaying the original member.
-
-The options `types user` and `includederivedmembership types user` return the same list of users.
-The `includederivedmembership` option makes less API calls but doesn't show hierarchy.
-Expanding a member of type CUSTOMER may produce a large volume of data as it will display all users in your domain.
-
-### Display group structure
-To see a group's structure of nested groups use the `type group` option.
-```
-$ gam show group-members group testgroup5 types group
-Group: testgroup5@domain.com
-  MEMBER, GROUP, testgroup1@domain.com, ACTIVE
-    MEMBER, GROUP, testgroup2@domain.com, ACTIVE
-  MEMBER, GROUP, testgroup3@domain.com, ACTIVE
-    MEMBER, GROUP, testgroup2@domain.com, ACTIVE
-    MEMBER, GROUP, testgroup4@domain.com, ACTIVE
-```
-To show the structure of all groups you can do the following; it will be time consuming for a large number of groups.
-```
-gam redirect stdout ./groups.txt show group-members types group
-```
-
-### Examples
-#### Print a CSV of all members of a group regardless of role, all fields
-```
-gam print group-members <GroupEntity>
-```
-#### Print a CSV containing all managers emails
-```
-gam print group-members <GroupEntity> role manager fields email
-```
-#### Print a CSV output of all members and their emails only
-```
-gam print group-members <GroupEntity> role member fields email
-```
-#### Display group owners in your domain, but excluding groups where the email starts with a 4 digit code
-```
-gam print group-members domain <Your Domain> emailmatchpattern not '^1234.*' roles owners
-```
-
-
-These options further limit the list of groups selected above:
-* `emailmatchpattern <REMatchPattern>` - Limit display to groups whose email address matches `<REMatchPattern>`
-* `emailmatchpattern not <REMatchPattern>` - Limit display to groups whose email address does not match `<REMatchPattern>`
-* `namematchpattern <REMatchPattern>` - Limit display to groups whose name matches `<REMatchPattern>`
-* `namematchpattern not <REMatchPattern>` - Limit display to groups whose name does not match `<REMatchPattern>`
-* `descriptionmatchpattern <REMatchPattern>` - Limit display to groups whose description matches `<REMatchPattern>`
-* `descriptionmatchpattern not <REMatchPattern>` - Limit display to groups whose description does not match `<REMatchPattern>`
-* `admincreatedmatch True` - Limit display to groups created by administrators
-* `admincreatedmatch False` - Limit display to groups created by users
-
-By default, all members, managers and owners in the group are displayed; these options modify that behavior:
-* `roles <GroupRoleList>` - Display specified roles
-* `members` - Display members
-* `managers` - Display managers
-* `owners` - Display owners
-
-By default, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
-* `types <GroupMemberTypeList>` - Display specified types
-
-By default, members that are groups are displayed as a single entry of type GROUP; this option recursively expands group members to display their user members.
-* `recursive` - Recursively expand group members
-
-When `recursive` is specified, the default is to only display type user members; this option modifies those behaviors:
-* `types <GroupMemberTypeList>` - Display specified types
-
-By default, when displaying members from a group, all members, whether suspended/archived or not, are included.
-* `notsuspended` - Display only non-suspended members
-* `suspended` - Display only suspended members
-* `notarchived` - Do not include archived members
-* `archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `notsuspended notarchived` - Do not include suspended and archived members
-* `suspended archived` - Include only suspended or archived members
-* `notsuspended archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `suspended notarchived` - Only include suspended members, this is not common but allows creating groups that allow easy identification of suspended users
-
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
-
-Members without an email address, e.g. `customer`, are considered internal.
-
-Members that have met the above qualifications to be displayed can be further qualifed by their email address.
-* `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
-* `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
-
-By default, the ID, role, email address, type and status of each member are displayed along with the group email address;
-these options specify which fields to display:
-* `membernames` - Display members full name; an additional API call per member is required
-* `showdeliverysettings` - Display delivery settings; an additional API call per member is required
-* `<MembersFieldName>*` - Individual field names
-* `fields <MembersFieldNameList>` - A comma separated list of field names
-    * `delivery|deliverysettings` - Specify this field to get delivery information; an additional API call per member is required
-
-For members that are users, you can specify additional information to display; an additional API call per member is required
-* `userfields <UserFieldNameList>` - Display specific user fields
-* `allschemas|(schemas|custom|customschemas <SchemaNameList>)` - Display all or specific custom schema values
-
-The additional API calls can be reduced with the `cachememberinfo` option; a single API call is made for each user/group
-and the data is cached to eliminate to need to repeat the API call; this consumes more memory but dramatically reduces the number of API calls.
-
-If member names are requested, names are not available for users not in the domain; you can request that GAM use the People API to retrieve
-names for these users. Names are not retrieved in all cases and success is dependent on what user is used to perform the retrievals.
-* `peoplelookup` - Use the administrator named in oauth2.txt to perform the retrievals
-* `peoplelookupuser <EmailAddress>` - Use `<EmailAddress>` to perform the retrievals
-
-By default, when `membernames` is specified, GAM displays `Unknown` for members whose names can not be determined.
-Use `unknownname <String>` to specify an alternative value.
-
-By default, the group email address is always shown, you can suppress it with the `nogroupemail` option.
-
-The `recursive` option adds two columns, level and subgroup, to the output:
-* `level` - At what level of the expansion does the user appear; level 0 is the top level
-* `subgroup` - The group that contained the user
-
-Displaying membership of multiple groups or recursive expansion may result in multiple instances of the same user being displayed; these multiple instances can be reduced to one entry.
-* `noduplicates` - Reduce multiple instances of the same user to the first instance
-
-The `includederivedmembership` option is an alternative to `recursive`; it causes the API to expand type GROUP and type CUSTOMER
-members to display their constituent members while still displaying the original member.
-The API produces inconsistent results, use with caution.
-
-The options `recursive noduplicates` and `includederivedmembership types user noduplicates` return the same list of users.
-The `includederivedmembership` option makes less API calls but doesn't show level and subgroup information.
-Expanding a member of type CUSTOMER may produce a large volume of data as it will display all users in your domain.
-
-By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
-* `formatjson` - Display the fields in JSON format.
-
-By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
-the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
-When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
-The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
-`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
-
-## Display group membership in hierarchical format
-```
-gam show group-members
-        [([domain|domains <DomainNameEntity>] ([member|showownedby <EmailItem>]|[(query <QueryGroup>)|(queries <QueryGroupList>)]))|
-         (group|group_ns|group_susp <GroupItem>)|
-         (select <GroupEntity>)]
-        [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
-        [descriptionmatchpattern [not] <REMatchPattern>]
-        [admincreatedmatch <Boolean>]
-        [roles <GroupRoleList>] [members] [managers] [owners] [depth <Number>]
-        [internal] [internaldomains <DomainNameList>] [external]
-        [notsuspended|suspended] [notarchived|archived]
-        [types <GroupMemberTypeList>]
-        [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
-        [includederivedmembership]
-```
-By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
-* `domain|domains <DomainNameEntity>` - Limit display to groups in the domains specified by `<DomainNameEntity>`
-  * You can predefine this list with the `print_agu_domains` variable in `gam.cfg`.
-* `member <EmailItem>` - Limit display to groups that contain `<EmailItem>` as a member; mutually exclusive with `query <QueryGroup>`
-* `showownedby <EmailItem>` - Limit display to groups that contain `<EmailItem>` as an owner; mutually exclusive with `query <QueryGroup>`
-* `(query <QueryGroup>)|(queries <QueryGroupList>)` - Limit groups to those that match a query; each query is run against each domain
-* `group <GroupItem>` - Limit display to the single group `<GroupItem>`
-* `group_ns <GroupItem>` - Limit display to the single group `<GroupItem>`, display non-suspended members
-* `group_susp <GroupItem>` - Limit display to the single group `<GroupItem>`, display suspended members
-* `select <GroupEntity>` - Limit display to the groups specified in `<GroupEntity>`
-* `showownedby <UserItem>` - Limit display to groups owned by `<UserItem>`
-
-When using `query <QueryGroup>` with the `name:{PREFIX}*` query, `PREFIX` must contain at least three characters.
-
-You can identify groups with the `All users in the organization` member with:
-* `query "memberKey=<CustomerID>"`
-* `member id:<CustomerID>`
-
-These options further limit the list of groups selected above:
-* `emailmatchpattern <REMatchPattern>` - Limit display to groups whose email address matches `<REMatchPattern>`
-* `emailmatchpattern not <REMatchPattern>` - Limit display to groups whose email address does not match `<REMatchPattern>`
-* `namematchpattern <REMatchPattern>` - Limit display to groups whose name matches `<REMatchPattern>`
-* `namematchpattern not <REMatchPattern>` - Limit display to groups whose name does not match `<REMatchPattern>`
-* `descriptionmatchpattern <REMatchPattern>` - Limit display to groups whose description matches `<REMatchPattern>`
-* `descriptionmatchpattern not <REMatchPattern>` - Limit display to groups whose description does not match `<REMatchPattern>`
-* `admincreatedmatch True` - Limit display to groups created by administrators
-* `admincreatedmatch False` - Limit display to groups created by users
-
-By default, all members, managers and owners in the group are displayed; these options modify that behavior:
-* `roles <GroupRoleList>` - Display specified roles
-* `members` - Display members
-* `managers` - Display managers
-* `owners` - Display owners
-
-By default, when displaying members from a group, all members, whether suspended/archived or not, are included.
-* `notsuspended` - Display only non-suspended members
-* `suspended` - Display only suspended members
-* `notarchived` - Do not include archived members
-* `archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `notsuspended notarchived` - Do not include suspended and archived members
-* `suspended archived` - Include only suspended or archived members
-* `notsuspended archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `suspended notarchived` - Only include suspended members, this is not common but allows creating groups that allow easy identification of suspended users
-
-By default, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
-* `types <GroupMemberTypeList>` - Display specified types
-
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
-
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed

wiki/Groups.md

@@ -396,7 +396,7 @@ gam info group|groups <GroupEntity>
         [basic] <GroupFieldName>* [fields <GroupFieldNameList>] [nodeprecated]
         [ciallfields|(cifields <CIGroupFieldNameList>)]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains All|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -423,13 +423,17 @@ By default, when displaying members from a group, all members, whether suspended
 By default, when displaying members from a group, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
 * `types <GroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your primary workspace domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
@@ -467,13 +471,14 @@ gam print groups [todrive <ToDriveAttribute>*]
         [ciallfields|(cifields <CIGroupFieldNameList>)]
         [nodeprecated]
         [roles <GroupRoleList>]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
         [includederivedmembership]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>] [sortheaders]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 ```
 By default, all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -557,21 +562,34 @@ By default, when displaying members from a group, all members, whether suspended
 By default, when displaying members from a group, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
 * `types <GroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
 * `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Home.md

@@ -10,7 +10,36 @@ To run all commands properly, GAM7 requires three things:
 * A special service account that is authorized to act on behalf of your users in order to modify user-specific settings and data such as Drive files, Calendars and Gmail messages and settings like signatures.
 
 # Documentation
-See the sections in the right-hand column for documentation.
+
+## Update History
+A log of updates to GAM7.
+
+## Installation
+Instructions detailing ways of installing GAM7 and alternate installation issues.
+
+## Configuration
+Instructions detailing configuration of GAM7 and alternate authorization methods.
+
+## Notes and Information
+References to resources that enhance your use of GAM7.
+
+## Definitions
+BNF definitions of common items in the GAM7 command syntax.
+
+## Command Processing
+Information regarding use of command line options to control how GAM7 operates.
+
+## Collections
+BNF Syntax definitions of ways to specify multiple Googlw Workspace opjects.
+
+## Client Access
+Syntax, descriptions and examples of commands that are executed by your Google Workspace administrator.
+
+## Special Service Account Access
+How to set up a GAM7 Chat Bot; this is required to use the Chat API to manage Chat Spaces in your Google Workspace.
+
+## Service Account Access
+Syntax, descriptions and examples of commands that are executed on behalf of your Google Workspace users.
 
 # Installation
 * [How to Install GAM7](How-to-Install-GAM7)

wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -252,10 +252,10 @@ writes the credentials into the file oauth2.txt.
 admin@server:/Users/admin$ rm -f /Users/admin/GAMConfig/oauth2.txt
 admin@server:/Users/admin$ gam version
 WARNING: Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /Users/admin/GAMConfig/oauth2.txt, Not Found
-GAM 7.28.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.02 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.0 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 
@@ -990,9 +990,9 @@ writes the credentials into the file oauth2.txt.
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
 WARNING: Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: C:\GAMConfig\oauth2.txt, Not Found
-GAM 7.28.01 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.32.02 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.0 64-bit final
+Python 3.14.2 64-bit final
 Windows 11 10.0.26200 AMD64
 Path: C:\GAM7
 Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com

wiki/List-Items.md

@@ -77,6 +77,7 @@
 <MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
 <NamespaceList> ::= "<Namespace>(,<Namespace>)*"
 <NotesNameList> ::= "<NotesName>(,<NotesName>)*"
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
 <OrgUnitList> ::= "<OrgUnitItem>(,<OrgUnitItem>)*"
 <OtherContactsResourceNameList> ::= "<OtherContactsResourceName>(,<OtherContactsResourceName>)*"
 <PeopleResourceNameList> ::= "<PeopleResourceName>(,<PeopleResourceName>)*"

wiki/Meta-Commands-and-File-Redirection.md

@@ -27,12 +27,13 @@ gam [<Select>] [showsections] [<SelectOutputFilter>|<SelectInputFilter>] [<Confi
 Select a section from gam.cfg and process a GAM command using values from that section.
 ```
 <Select> ::=
-        select <Section> [save] [verify]
+        select <Section> [save] [verify [variables <RESearchPattern>]]
 ```
 - `save`
   - Set `section = <Section>` in the `[DEFAULT]` section and write configuration data to gam.cfg
 - `verify`
   - Print the variable values for the selected section
+  - Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
   - Values are determined in this order: Selected section, DEFAULT section, Program default
 
 If you enter `gam select <SectionName>` and nothing else on the command line,
@@ -80,7 +81,7 @@ Set variables in gam.cfg.
 
 ```
 <Config> ::=
-        config (<VariableName> [=] <Value>)* [save] [verify]
+        config (<VariableName> [=] <Value>)* [save] [verify [variables <RESearchPattern>]]
 ```
 - `<VariableName> [=] <Value>`
   - Set `<VariableName> = <Value>` in the current section
@@ -90,6 +91,7 @@ Set variables in gam.cfg.
   - Write configuration data to gam.cfg
 - `verify`
   - Print the variable values for the current section
+  - Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
   - Values are determined in this order: Current section, DEFAULT section, Program default
 
 You can prefix `<Config>` with `<Select>` to set a variable in a particular section.

wiki/Organizational-Units.md

@@ -32,7 +32,6 @@
 <OrgUnitFieldName> ::=
         description|
         id|orgunitid|
-        inherit|blockinheritance|
         name|
         parentid|parentorgunitid|
         parent|parentorgunitpath|
@@ -73,18 +72,15 @@ For quoting rules, see: [List Quoting Rules](Command-Line-Parsing)
 Create, update and delete organization units.
 ```
 gam create org|ou <OrgUnitPath> [description <String>]
-        [parent <OrgUnitItem>] [inherit|(blockinheritance False)]
+        [parent <OrgUnitItem>]
         [buildpath]
 gam update org|ou <OrgUnitPath> [name <String>] [description <String>]
-        [parent <OrgUnitItem>] [inherit|(blockinheritance False)]
+        [parent <OrgUnitItem>]
 gam delete org|ou <OrgUnitPath>
 gam update orgs|ous <OrgUnitEntity> [name <String>] [description <String>]
-        [parent <OrgUnitItem>] [inherit|(blockinheritance False)]
+        [parent <OrgUnitItem>]
 gam delete orgs|ous <OrgUnitEntity>
 ```
-Inheritance specifies whether sub-OUs of the specified OU inherit its settings.
-* `inherit|blockinheritance false` - Sub-OUs inherit settings from the specified OU; this is the default
-
 ## Add users to an organizational unit
 When adding users to an OU, Gam uses a batch method to speed up processing. 
 

wiki/Other-Resources.md

@@ -14,5 +14,10 @@ Thank you.
 * Korey Rideout - https://chatgpt.com/g/g-PTxxnVPMG-gam-assist-now-turbocharged-with-gam7
 * Paul Ogier (Taming.Tech) - GAM7 Course on Udemy https://taming.tech/GAMCourse
 * Paul Ogier (Taming.Tech) - GAM7 Tutorials https://www.youtube.com/watch?v=g9LDeyXQNLI&list=PL_dLiK09pJVhKJxZHNk9CHK0q5hkZ856w
+* Paul Ogier (Taming.Tech) - Installation videos
+  * GAM7 Windows Install - https://www.youtube.com/watch?v=l8pTF5UWz7o&list=PL_dLiK09pJVhKJxZHNk9CHK0q5hkZ856w&index=4
+  * GAM7 macOS Install - https://www.youtube.com/watch?v=eaLWpxhC91w&list=PL_dLiK09pJVhKJxZHNk9CHK0q5hkZ856w&index=5
+  * GAM7 Ubuntu Linux Install - https://www.youtube.com/watch?v=zBwhNTxGlcM&list=PL_dLiK09pJVhKJxZHNk9CHK0q5hkZ856w&index=7
+  * GAM7 ChromeOS Install - https://www.youtube.com/watch?v=BNWQh8GqvgY&list=PL_dLiK09pJVhKJxZHNk9CHK0q5hkZ856w&index=6
 * Paul Ogier (Taming.Tech) - https://taming.tech/taming-gam-a-practical-guide-to-gam-and-gamadv-xtd3/
 * Steve Larsen - https://docs.google.com/spreadsheets/d/1MzzA-u-cmoQcJnQOovCnZcEKMjvOyFhfkdFdf10X_GI/edit

wiki/Reports.md

@@ -12,10 +12,14 @@
 - [User reports](#user-reports)
 
 ## API documentation
-Changes starting 2025-10-29.
+* [Activity Data Sources](https://support.google.com/a/answer/11482175)
 
+Changes starting 2025-10-29.
 * [Reports API - Admin log event changes](https://support.google.com/a/answer/16601511)
 
+Changes starting 2025-12-20
+* [Reports API - Admin log enhancements](https://workspaceupdates.googleblog.com/2025/12/google-workspace-audit-log-api.html)
+
 These pages show event/parameter names; scroll down in the left column to: Reports.
 
 * [Reports API - Activities](https://developers.google.com/admin-sdk/reports/v1/reference/activities)
@@ -24,6 +28,8 @@ These pages show event/parameter names; scroll down in the left column to: Repor
 
 ## Definitions
 ```
+<NumberRange> ::= <Number>|(<Number>/<Number>)
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
 <DayOfWeek> ::= mon|tue|wed|thu|fri|sat|sun
 <Time> ::=
         <Year>-<Month>-<Day>(<Space>|T)<Hour>:<Minute>:<Second>[.<MilliSeconds>](Z|(+|-(<Hour>:<Minute>))) |
@@ -45,53 +51,70 @@ config csv_output_row_filter "'\"accounts:used_quota_in_mb\":count>15000'"
 ## Activity reports
 ```
 <ActivityApplicationName> ::=
+        accessevaluation|
         accesstransparency|access|
         admin|
+        admindataaction|
+        assignments|
         calendar|calendars|
         chat|
         chrome|
         classroom|
+        cloudsearch|
+        contacts|
         contextawareaccess|
-        gplus|currents|google+|
+        datamigration|
         datastudio|
+        directorysync|
         drive|doc|docs|
         gcp|cloud|
         geminiinworkspaceapps|gemini|geminiforworkspace|
+        gmail|
+        gplus|currents|google+|
+        graduation|
         groups|group|
         groupsenterprise|enterprisegroups|
         jamboard|
         keep|
+        ldap|
         login|logins|
         meet|hangoutsmeet|
+        meethardware|
         mobile|devices|
+        profile|
         rules|
         saml|
+        takeout|
+        tasks|
         token|tokens|oauthtoken|
         useraccounts|
         vault
 
 gam report <ActivityApplicationName> [todrive <ToDriveAttribute>*]
         [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
+        [userisactor]
         [([start <Time>] [end <Time>])|(range <Time> <Time>)|
          yesterday|today|thismonth|(previousmonths <Integer>)]
         [filter <String> (filtertime<String> <Time>)*]
         [event|events <EventNameList>] [ip <String>]
-        [groupidfilter <String>]
+        [gmaileventtypes <NumberRangeList>]
+        [groupidfilter <String>] [resourcedetailsfilter <String>]
         [maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
         [countsonly [bydate|summary] [eventrowfilter]]
         (addcsvdata <FieldName> <String>)* [shownoactivities]
 ```
 Select the application with `<ActivityApplicationName>`.
 
-For all `<ActivityApplicationNames>` other than `admin`, select the users for whom information is desired.
+For all `<ActivityApplicationNames>`, select the users for whom information is desired.
 * `user all` - All users, the default; there is one API call
 * `user <UserItem>` - An individual user; there is one API call
 * `orgunit|org|ou <OrgUnitPath>` - All users in the specified OU; there is one API call
   * `showorgunit` - Add a column labelled `actor.orgUnitPath` to the output; an additional API call is made to get the email addresses of the users in `<OrgUnitPath>`
 * `select <UserTypeEntity>` - A selected collection of users, e.g., `select group staff@domain.com`; there is one API call per user
 
-For `<ActivityApplicationName>` `admin`, the users selected are the admins that executed the command, not the targeted user.
-Use `filter "USER_EMAIL==user@domain.com"` to select the targeted user.
+For `<ActivityApplicationName>` `admin` and `chrome`, `orgunit|org|ou <OrgUnitPath>` does not work, use `select ou <OrgUnitPath>`.
+
+For `<ActivityApplicationName>` `admin`, use option `userisactor` to  display activities where the user executed the command that generated the activity.
 
 Limit the time period.
 * `start <Time>`
@@ -102,6 +125,20 @@ Limit the time period.
 * `thismonth` - The current calendar month up to the current time
 * `previousmonths <Integer>` - A number in the range 1 to 6 indicating calendar months previous to the current month
 
+For `gam report gmail`, `start <Time>` and `end <Time>` should both be provided, and the scan duration should not be greater than 30 days.
+GAM will supply missing values:
+* No time information provided - GAM sets `range -30d today`
+* Only `start <Time>`  provided - GAM sets `end <Time>+30d`
+* Only `end <Time>` provided - GAM sets `start <Time>-30d`
+
+For `gam report gmail`, `gmaileventtypes <NumberRangeList>` can be used to limit the event types displayed.
+* See: https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gmail
+
+You can use the following filter to select a specific event; replace `X` with your desired value.
+```
+filter "event_info.mail_event_type==X"
+```
+
 Apply API filters.
 * `filter|filters <String>` - `<String>` is a comma separated list of filter expressions.
 
@@ -110,6 +147,12 @@ The `filtertime<String> <Time>` value replaces the string `#filtertime<String>#`
 The characters following `filtertime` can be any combination of lowercase letters and numbers. This is most useful in scripts
 where you can specify a relative date without having to change the script.
 
+Limit to those users that are a member of at least one of a list of groups.
+* `groupidfilter <String>` - Format: "id:abc123,id:xyz456"
+
+Limit based on resource details.
+* `resourcedetailsfilter <String>` - See: https://developers.google.com/workspace/admin/reports/reference/rest/v1/activities/list#query-parameters
+
 You can use `config csv_output_row_filter` to filter the events if the API filter can't produce the results you want.
 
 Limit to a list of specific events.
@@ -118,9 +161,6 @@ Limit to a list of specific events.
 Limit to a specific IP address.
 * `ip <String>`
 
-Limit to those users that are a member of at least one of a list of groups.
-* `groupidfilter <String>` - Format: "id:abc123,id:xyz456"
-
 Limit the total number of activites.
 * `maxactivities <Number>`
 

wiki/Resources.md

@@ -84,6 +84,7 @@ See [Collections of Items](Collections-of-Items)
         (zipcode|postalcode <String>)
 
 <ResourceAttribute> ::=
+        (autoacceptinvitations [<Boolean>])|
         (addfeatures <FeatureNameList>)|
         (buildingid <BuildingID>)|
         (capacity <Number>)|
@@ -99,6 +100,7 @@ See [Collections of Items](Collections-of-Items)
 
 <ResourceFieldName> ::=
         acls|
+        autoacceptinvitations|
         buildingid|
         calendar|
         capacity|

wiki/Scripts.md

@@ -1,7 +1,7 @@
 # Scripts
 
-These scripts can be used to enhance GAM's capabilities; all are supported with Advanced GAM,
-many are supported with Legacy GAM. They require that Python 3 be installed on you computer.
+These scripts can be used to enhance GAM's capabilities; all are supported with GAM7,
+many are supported with Legacy GAM. They require that Python 3.10 or higher be installed on your computer.
 
 * https://github.com/taers232c/GAM-Scripts3
 * https://www.python.org/

wiki/Shared-Drives.md

@@ -41,6 +41,7 @@
 * [Move content to Shared Drives](https://support.google.com/a/answer/7374057)
 * [Shared Drive Limits](https://support.google.com/a/users/answer/7338880)
 * [Shared Drives in Org Units](https://support.google.com/a/answer/7337635)
+* [Shared Drive Restrictions](https://developers.google.com/workspace/drive/api/guides/manage-shareddrives#backward-compatibility)
 
 ## Query documentation
 * [Shared Drives Search](https://developers.google.com/drive/api/guides/search-shareddrives)
@@ -80,6 +81,15 @@
 <ColorValue> ::= <ColorName>|<ColorHex>
 ```
 ```
+<CSVFileInput> ::=
+        ((<FileName> [charset <Charset>] )|
+         (gsheet <UserGoogleSheet>)|
+         (gdoc <UserGoogleDoc>)|
+         (gcscsv <StorageBucketObjectName>)|
+         (gcsdoc <StorageBucketObjectName>))
+        [warnifnodata] [columndelimiter <Character>] [noescapechar <Boolean>] [quotechar <Character>]
+        [endcsv|(fields <FieldNameList>)]
+
 <JSONData> ::= (json [charset <Charset>] <String>) | (json file <FileName> [charset <Charset>]) |
 
 <OrganizerType> ::= user|group
@@ -94,7 +104,8 @@
 <REMatchPattern> ::= <RegularExpression>
 <RESearchPattern> ::= <RegularExpression>
 <RESubstitution> ::= <String>>
-
+```
+```
 <DriveFileOrderByFieldName> ::=
         createddate|createdtime|
         folder|
@@ -288,6 +299,10 @@ gam [<UserTypeEntity>] create shareddrive <Name>
 * `[restrictions.]<SharedDriveRestrictionsSubfieldName> <Boolean>` - Set Shared Drive Restrictions
 * `hide <Boolean>` - Set Shared Drive visibility
 
+`<SharedDriveRestrictionsSubfieldName>` `copyrequireswriterpermission` can not be used with
+`downloadrestrictedforreaders|downloadrestrictions.restrictedforreaders` or
+`downloadrestrictedforreadersdownloadrestrictions.restrictedforwriters`.
+
 If any attributes other than `themeid` are specified, GAM must create the Drive and then update the Drive attributes.
 Even though the Create API returns success, the Update API fails and reports that the Drive does not exist. 
 * `errorretries <Integer>` - Number of create/update error retries; default value 5, range 0-10
@@ -370,6 +385,10 @@ gam [<UserTypeEntity>] update shareddrive <SharedDriveEntity> [name <Name>]
 * `[restrictions.]<SharedDriveRestrictionsSubfieldName> <Boolean>` - Set Shared Drive Restrictions
 * `hidden <Boolean>` - Set Shared Drive visibility
 
+`<SharedDriveRestrictionsSubfieldName>` `copyrequireswriterpermission` can not be used with
+`downloadrestrictedforreaders|downloadrestrictions.restrictedforreaders` or
+`downloadrestrictedforreadersdownloadrestrictions.restrictedforwriters`.
+
 * `ou|org|orgunit <OrgUnitItem>` - See: https://workspaceupdates.googleblog.com/2022/05/shared-drives-in-organizational-units-open-beta.html
 
 This option is only available when the command is run as an administrator.
@@ -649,15 +668,23 @@ When deleting permissions from JSON data, permissions with role `owner` true are
 These commands are used to transfer ACLs from one Shared Drive to another.
 * `copy` - Copy all ACLs from the source Shared Drive to the target Shared Drive. The role of an existing ACL in the target Shared Drive will never be reduced.
 * `sync` - Add/delete/update ACLs in the target Shared Drive to match those in the source Shared Drive.
+
+* `<UserTypeEntity>` - Not Specified
+  * All Shared Drives must be in the same workspace as the admin in `oauth2.txt`.
+* `<UserTypeEntity>` - Specified
+  * `adminaccess|asadmin` specified - All Shared Drives must be in the same workspace as `<UserTypeEntity>`.
+  * `adminaccess|asadmin` not specified - Shared Drives can be in separate workspaces if `<UserTypeEntity>` in a manager of all of them.
 ```
 gam [<UserTypeEntity>] copy shareddriveacls <SharedDriveEntity> to <SharedDriveEntity>
         [showpermissionsmessages [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
         [adminaccess|asadmin]
 gam [<UserTypeEntity>] sync shareddriveacls <SharedDriveEntity> with <SharedDriveEntity>
         [showpermissionsmessages [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
         [adminaccess|asadmin]
 ```
@@ -665,8 +692,14 @@ When `excludepermissionsfromdomains <DomainNameList>` is specified, any ACL that
 
 When `includepermissionsfromdomains <DomainNameList>` is specified, only ACLs that reference a domain in `<DomainNameList>` will be copied.
 
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>` will be modified
+to reference the second `<EmailAddress>` when copied; the original ACL is not modified. The option can be repeated if multiple email addresses are to be mapped.
+
+Bulk permission email address mapping can be specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
 When `mappermissionsdomain <DomainName> <DomainName>` is specifed, any ACL that references the first `<DomainName>` will be modified
-to reference the second `<DonainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to me mapped.
+to reference the second `<DomainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to be mapped.
 
 ## Display Shared Drive access
 

wiki/Users-Calendars-Access.md

@@ -145,40 +145,8 @@ The `quotechar <Character>` option allows you to choose an alternate quote chara
 ## Transfer calendar ownership
 
 You can transfer ownership of calendars from one user to another; only non-primary calendars owned by the source user can be transferred.
-```
-gam <UserTypeEntity> transfer calendars|seccals <UserItem> [<UserCalendarEntity>]
-        [keepuser | (retainrole <CalendarACLRole>)] [sendnotifications <Boolean>]
-        [noretentionmessages]
-        [<CalendarSettings>] [append description|location|summary] [noupdatemessages]
-        [deletefromoldowner] [addtonewowner <CalendarAttribute>*] [nolistmessages]
-```
-If `<UserCalendarEntity>` is not specified, all of a user's owned secondary calendars will be transferrdd.
 
-By default, the users in `<UserTypeEntity>` retain no role in the transferred calendars.
-* `keepuser` - The users in `<UserTypeEntity>` retain their ownership.
-* `retainrole <CalendarACLRole>` - The users in `<UserTypeEntity>` retain the specified role.
-* `noretentionmessages` - Suppress the original owner role retention messages.
+This capability is no longer available, see: https://developers.google.com/workspace/calendar/release-notes#October_27_2025
 
-By default, when you add or update a calendar ACL, a notification is sent to the affected users; use `sendnotifications false` to suppress sending the notifications.
+Data ownership can be transferred in the Google Calendar UI.
 
-You can update calendar settings as part of the transfer. In description, location and summary, #email#, #user# and #username# will be replaced
-by the original owner's full email address or just the name portion; #timestamp# will be replaced by the current date and time.
-* `<CalendarSettings>` - The value specified will replace the existing value.
-* `append description|location|summary` - The specified <CalendarSettings> value will be appended to the existing value.
-* `noupdatemessages` - Suppress the settings update messages.
-
-You can manipulate the old and new owner's calendar lists.
-* `deletefromoldowner` - Delete the calendar from the old owner's calendar list
-* `addtonewowner <CalendarAttribute>*` - Add the calendar to the new owner's calendar list; optionally specify attributes
-* `nolistmessages` - Suppress the calendar list add/delete messages.
-
-### Example
-Transfer a secondary calendar from oldowner to newowner. Remove the calendar from the old owner's calendar list and add to the new owner's  calendar list.
-```
-gam user oldowner@domain.com transfer calendars newowner@domain.com c_aaa123zzz@group.calendar.google.com removefromoldowner addtonewowner
-```
-
-Transfer ownership of all non-primary calendars from oldowner to newowner; append a message to the calendar description noting the old owner and the time of transfer.
-```
-gam user oldowner@domain.com transfer calendars newowner@domain.com minaccessrole owner description "(Transferred from #user# on #timestamp#)" append description
-```

wiki/Users-Calendars-Events.md

@@ -114,6 +114,8 @@
 <CourseState> ::= active|archived|provisioned|declined
 <CourseStateList> ::= all|"<CourseState>(,<CourseState>)*"
 <iCalUID> ::= <String>
+<MeetID> ::= <String>
+       Must match this Python Regular Expression: [a-z]{3}-[a-z]{4}-[a-z]{3}
 <ResourceID> ::= <String>
 <ResourceIDList> ::= "<ResourceID>(,<ResourceID>)*"
 <UniqueID> ::= id:<String>
@@ -215,7 +217,8 @@
         endtimeunspecified|
         extendedproperties|
         eventtype|
-        <EventFocusTimePropertiesSubfieldName>
+        focustimeproperties|
+        <EventFocusTimePropertiesSubfieldName>|
         gadget|
         guestscaninviteothers|
         guestscanmodify|
@@ -229,7 +232,8 @@
         organizer|
         <EventOrganizerSubfieldName>|
         originalstart|originalstarttime|
-        <EventOutOfOfficePropertiesSubfieldName>
+        outofofficeproperties|
+        <EventOutOfOfficePropertiesSubfieldName>|
         privatecopy|
         recurrence|
         recurringeventid|
@@ -320,6 +324,7 @@
         (birthday <Date>)|
         (color <EventColorName>)|
         (colorindex|colorid <EventColorIndex>)|
+        (conferencedata meet <MeetID>)|
         (description <String>)|
         (end|endtime (allday <Date>)|<Time>)|
         (guestscaninviteothers <Boolean>)|
@@ -327,7 +332,7 @@
         (guestscanmodify <Boolean>)|
         (guestscanseeotherguests <Boolean>)|
         guestscantseeotherguests|
-        hangoutsmeet|
+        googlemeet|hangoutsmeet|
         <JSONData>|
         (jsonattendees [charset <Charset>] <String>)|
         (jsonattendees file <FileName> [charset <Charset>])|
@@ -368,7 +373,7 @@ The following attributes are equivalent:
         <EventAttribute>|
         clearattachments|
         clearattendees|
-        clearhangoutsmeet|
+        cleargooglemeet|clearhangoutsmeet|
         (clearprivateproperty <PropertyKey>)|
         clearresources|
         (clearsharedproperty <PropertyKey>)|
@@ -591,11 +596,16 @@ Use `jsonattendees file ./attendees.json` in `create/update event`.
 
 ## Delete selected calendar events
 ```
-gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 ```
 If `<EventEntity>` is not specified, all events in `<UserCalendarEntity>` are selected. This is not typically used.
 
+By default, each event is deleted in a separate API call, use `batchsize` with an integer between 1 and 1000
+to delete the events in batches.
+
 No events are deleted unless you specify the `doit` option; omit `doit` to verify that you properly selected the events to delete.
 
 When events are deleted from a calendar, they are moved to the calendar's trash and are only permanently deleted (purged) after 30 days.
@@ -671,9 +681,10 @@ By default, Gam displays event details, use `countsonly` to display only the num
 
 ```
 gam <UserTypeEntity> print events <UserCalendarEntity> [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         (addcsvdata <FieldName> <String>)*
-        [eventrowfilter]                                                                                          [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
+        [eventrowfilter]
+        [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
 ```
 In `<EventEntity>`, any `<EventSelectProperty>` options must precede all other options.
 
@@ -684,6 +695,10 @@ option `singleevents` to display all instances of a recurring event.
 
 `showdayofweek` displays columns `start.dayOfWeek` and `end.dayOfWeek` when event start and end times are displayed.
 
+By default, each attendee is displayed in a separate column; `attendeeslist` causes GAM to display
+the attendee email addresses in a single column `attendeesList`; no attendee details are displayed.
+The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
 Add additional columns of data from the command line to the output after the calendarId.
 * `addcsvdata <FieldName> <String>`
 
@@ -718,7 +733,7 @@ properly processed.
 ```
 gam <UserTypeEntity> update calattendees <UserCalendarEntity> <EventEntity> [anyorganizer]
         [<EventNotificationAttribute>] [splitupdate] [dryrun|doit]
-        (csv|csvfile <CSVFileInput>)
+        (csv|csvfile <CSVFileInput> endcsv)
         (delete <EmailAddress>)*
         (deleteentity <EmailAddressEntity>)*
         (add <EmailAddress>)*
@@ -774,27 +789,43 @@ The attendee changes are displayed but not processed unless `doit` is specified.
 ## Focus time events
 
 ## Manage focus time events
-You can create and delete focus time events; they can not be updated.
-To update a focus time event, delete the focus time event and recreate it.
+To update a focus time event, see: [Update calendar events](#update-calendar-events)
 ```
 gam <UserTypeEntity> create focustime
         [chatstatus available|donotdisturb]|
         [declinemode none|all|new] [declinemessage <String>]|
         [summary <String>]
-        (timerange <Time> <Time>
-        (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time> (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*))+
+        [timezone <String>]
+        (noreminders|(reminder email|popup <Number>)+)
 
 gam <UserTypeEntity> delete focustime
-        (timerange <Time> <Time>)+
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time>))+
 ```
 
-focus time events span a time range:
+Focus time events span a time range:
+* `date yyyy-mm-dd` - A specific day
+* `range yyyy-mm-dd yyyy-mm-dd` - Every day in the range
+* `daily yyyy-mm-dd <Number>` - Every day starting on the date for `<Number>` total days
+* `weekly yyyy-mm-dd <Number>` - A day per week starting on the date for `<Number>` total weeks
 * `timerange <Time> <Time>` - A time range, may span multiple days
 
 ## Display focus time events
 ```
 gam <UserTypeEntity> show focustime
-        (timerange <Time> <Time>)+
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time>))+
         [showdayofweek]
         [formatjson]
 ```
@@ -805,7 +836,11 @@ By default, Gam displays the information as an indented list of keys and values.
 
 ```
 gam <UserTypeEntity> print focustime
-        (timerange <Time> <Time>)+
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time>))+
         [showdayofweek]
         [formatjson [quotechar <Character>]] [todrive <ToDriveAttribute>*]
 ```
@@ -825,27 +860,39 @@ The `quotechar <Character>` option allows you to choose an alternate quote chara
 ## Out of office events
 
 ## Manage out of office events
-You can create and delete out of office events; they can not be updated.
-To update an out of office event, delete the out of office event and recreate it.
+To update an out of office event, see: [Update calendar events](#update-calendar-events)
 ```
 gam <UserTypeEntity> create outofoffice
         [declinemode none|all|new]
         [declinemessage <String>]
         [summary <String>]
-        (timerange <Time> <Time>
-        (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time> (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*))+
+        [timezone <String>]
+        (noreminders|(reminder email|popup <Number>)+)
 
 gam <UserTypeEntity> delete outofoffice
         (timerange <Time> <Time>)+
 ```
 
 Out of office events span a time range:
+* `date yyyy-mm-dd` - A specific day
+* `range yyyy-mm-dd yyyy-mm-dd` - Every day in the range
+* `daily yyyy-mm-dd <Number>` - Every day starting on the date for `<Number>` total days
+* `weekly yyyy-mm-dd <Number>` - A day per week starting on the date for `<Number>` total weeks
 * `timerange <Time> <Time>` - A time range, may span multiple days
 
 ## Display out of office events
 ```
 gam <UserTypeEntity> show outofoffice
-        (timerange <Time> <Time>)+
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time>))+
         [showdayofweek]
         [formatjson]
 ```
@@ -856,6 +903,11 @@ By default, Gam displays the information as an indented list of keys and values.
 
 ```
 gam <UserTypeEntity> print outofoffice
+        ((date yyyy-mm-dd)|
+         (range yyyy-mm-dd yyyy-mm-dd)|
+         (daily yyyy-mm-dd <Number>)|
+         (weekly yyyy-mm-dd <Number>)|
+         (timerange <Time> <Time>))+
         (timerange <Time> <Time>)+
         [showdayofweek]
         [formatjson [quotechar <Character>]] [todrive <ToDriveAttribute>*]
@@ -888,7 +940,9 @@ gam <UserTypeEntity> create workinglocation
          (range yyyy-mm-dd yyyy-mm-dd)|
          (daily yyyy-mm-dd <Number>)|
          (weekly yyyy-mm-dd <Number>)|
-         (timerange <Time> <Time>))+
+         (timerange <Time> <Time> (recurrence <RRULE, EXRULE, RDATE and EXDATE line>)*))+
+        [timezone <String>]
+        (noreminders|(reminder email|popup <Number>)+)
 
 gam <UserTypeEntity> delete workinglocation
         ((date yyyy-mm-dd)|

wiki/Users-Calendars.md

@@ -42,13 +42,16 @@
         editor|freebusy|freebusyreader|owner|reader|writer
 
 <CalendarSettings> ::=
+        (autoacceptinvitations [<Boolean>])|
         (description <String>)|
         (location <String>)|
         (summary <String>)|
         (timezone <TimeZone>)
 
 <CalendarSettingsField> ::=
+        autoacceptinvitations|3
         conferenceproperties|
+        dataowner|
         description|
         id|
         location|
@@ -134,6 +137,7 @@
         backgroundcolor|
         colorid|
         conferenceproperties|
+        dataowner|
         defaultreminders|
         deleted|
         description|
@@ -286,11 +290,10 @@ By default, Gam displays the information as an indented list of keys and values.
 gam <UserTypeEntity> print calendars [todrive <ToDriveAttribute>*]
          [primary] <CalendarSelectProperty>*
          [noprimary] [nogroups] [noresources] [nosystem] [nousers]
-         [fields <CalendarListFieldList>] [permissions]
+         [fields <CalendarListFieldList>] [permissions] [oneitemperrow]
          [formatjson] [delimiter <Character>] [quotechar <Character>]
 ```
 By default, information for all visible, non-deleted calendars is shown.
-* `permissions` adds permission information for user owned calendars to the output.
 * `primary` - Limits the selection to the user's primary calendar
 * `<CalendarSelectProperty>`
     * `minaccessrole <CalendarACLRole>`- Limits the selection to those calendars where the user's role is at least `<CalendarACLRole>`
@@ -301,6 +304,8 @@ By default, information for all visible, non-deleted calendars is shown.
 * `noresources` - Do not display resource calendars, email address ends in "@resource.calendar.google.com"
 * `nosystem` - Do not display system calendars, email address ends in "@group.v.calendar.google.com"
 * `nousers` - Do not display users calendars, email address ends in `domain` value from `gam.cfg`.
+* `permissions` Adds permission information for user owned calendars to the output.
+* `oneitemperrow` - Each permission is output on a separate row with all of the other calendar fields.
 
 By default, list items are separated by the `csv_output_field_delimiter' from `gam.cfg`.
 * `delimiter <Character>` - Separate list items with `<Character>`

wiki/Users-Chat.md

@@ -7,6 +7,10 @@
 - [Chat Space Permissions](#chat-space-permissions)
 - [Manage Chat Spaces](#manage-chat-spaces)
 - [Display Chat Spaces](#display-chat-spaces)
+- [Manage Chat User Sections](#manage-chat-user-sections)
+- [Display Chat User Sections](#display-chat-user-sections)
+- [Manage Chat User Section Items](#manage-chat-user-section-items)
+- [Display Chat User Section Items](#display-chat-user-section-items)
 - [UI API member role mapping](#ui-api-mwmber-role-mapping)
 - [Manage Chat Members](#manage-chat-members)
 - [Display Chat Members](#display-chat-members)
@@ -30,7 +34,10 @@ gam user user@domain.com update serviceaccount
 [*]  8)  Chat API - Spaces Admin (supports readonly)
 [*]  9)  Chat API - Spaces Delete
 [*] 10)  Chat API - Spaces Delete Admin
+[*] 11)  Chat API - User Sections (supports readonly)
+
 ```
+`Chat API - User Sections` is in Developer Preview; you must have a `developer_preview_api_key` in `gam.cfg` to use these commands.
 
 Added `use_chat_admin_access` Boolean variable to `gam.cfg`. 
 ```
@@ -60,6 +67,7 @@ Google requires that you have a Chat Bot configured in order to use the Chat API
 * [Chat API - Members](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.members/list)
 * [Chat API - Messages](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.messages/list)
 * [Chat API - Events](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.spaceEvents/list)
+* [Chat API - User Sections](https://developers.google.com/workspace/chat/api/reference/rest/v1/users.sections)
 * [Apps in Google Chat](https://support.google.com/chat/answer/7655820)
 * [Manage customemoji permissions](https://support.google.com/a/answer/12850085)
 * [Manage Spaces in Admin Console](https://support.google.com/a/answer/13369245)
@@ -96,6 +104,8 @@ Google requires that you have a Chat Bot configured in order to use the Chat API
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMemberList> ::= "<ChatMember>(,<ChatMember>)*"
 <ChatMessage> ::= spaces/<String>/messages/<String>
+<ChatSection> ::= users/<String>/sections/<String> | sections/<String> | section <String>
+<ChatSectionItem> ::= users/<String>/sections/<String>/items/<String> | sections/<String>/items/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChatSpaceType> ::=
@@ -422,6 +432,83 @@ When using the `formatjson` option, double quotes are used extensively in the da
 The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
 `quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
 
+## Manage Chat User Sections
+### Create a user's chat section
+```
+gam <UserTypeEntity> create chatsection
+        displayname <String>
+        [formatjson|returnidonly]
+```
+
+### Update a user's chat section
+```
+gam <UserTypeEntity> update chatsection <ChatSection>
+        [displayname <String>]
+        [(sortorder <Integer>)|(position start|end)]
+        [formatjson]
+```
+
+### Delete a user's chat section
+```
+gam <UserTypeEntity> delete chatsection <ChatSection>
+```
+
+## Display Chat User Sections
+### Display information about all of a user's chat sections
+```
+gam <UserTypeEntity> show chatsections
+        [formatjson]
+```
+By default, Gam displays the information as an indented list of keys and values.
+* `formatjson` - Display the fields in JSON format.
+```
+gam <UserTypeEntity> print chatsections [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+## Manage Chat User Section Items
+### Move a user's chat section item to a different chat section
+```
+gam <UserTypeEntity> move chatsectionitem <ChatSectionItem> to <ChatSection>
+```
+
+## Display Chat User Section Items
+### Display information about a user's chat section items
+```
+gam <UserTypeEntity> show chatsectionitems <ChatSection>
+        [space <ChatSpace>]
+        [formatjson]
+```
+You can search for a chat section that contains a chat space with:
+`show chatsectionitems sections/- space <ChatSpace>`
+
+By default, Gam displays the information as an indented list of keys and values.
+* `formatjson` - Display the fields in JSON format.
+```
+gam <UserTypeEntity> print chatsectionitems  <ChatSection> [todrive <ToDriveAttribute>*]
+        [space <ChatSpace>]
+        [formatjson [quotechar <Character>]]
+```
+You can search for a chat section that contains a chat space with:
+`print  chatsectionitems sections/- space <ChatSpace>`
+
+By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
 ## UI API member role mapping
 GAM uses the Chat UI role names.
 

wiki/Users-Drive-Copy-Move.md

@@ -26,19 +26,34 @@
 * [`<UserTypeEntity>`](Collections-of-Users)
 
 ```
+<CSVFileInput> ::=
+        ((<FileName> [charset <Charset>] )|
+         (gsheet <UserGoogleSheet>)|
+         (gdoc <UserGoogleDoc>)|
+         (gcscsv <StorageBucketObjectName>)|
+         (gcsdoc <StorageBucketObjectName>))
+        [warnifnodata] [columndelimiter <Character>] [noescapechar <Boolean>] [quotechar <Character>]
+        [endcsv|(fields <FieldNameList>)]
+
 <RegularExpression> ::= <String>
         See: https://docs.python.org/3/library/re.html
 <REMatchPattern> ::= <RegularExpression>
 <RESearchPattern> ::= <RegularExpression>
 <RESubstitution> ::= <String>>
 
+<MimeTypeName> ::= application|audio|font|image|message|model|multipart|text|video
+<MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
+<MimeType> ::= <MimeTypeName>/<String>
+<MimeTypeList> ::= "<MimeType>(,<MimeType>)*"
+
 <CorporaAttribute> ::= allteamdrives|domain|onlyteamdrives|user
 <DomainName> ::= <String>(.<String>)+
 <DomainNameList> ::= "<DomainName>(,<DomainName>)*"
 <EmailAddress> ::= <String>@<DomainName>
 <UniqueID> ::= id:<String>
 <UserItem> ::= <EmailAddress>|<UniqueID>|<String>
-
+```
+```
 <DriveFileACLRole> ::=
         manager|organizer|owner|
         contentmanager|fileorganizer|
@@ -89,8 +104,13 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         <DriveFileCopyAttribute>*
         [skipids <DriveFileEntity>]
         [copysubfiles [<Boolean>]] [filenamematchpattern <REMatchPattern>]
-             [filemimetype [not] <MimeTypeList>]
-        [copysubfilesownedby any|me|others]
+             [filemimetype [not] <MimeTypeList>] [filemimetype category <MimeTypeNameList>]
+        [copysubfilesownedby
+            any|me|others|
+            users <EmailAddressList>|
+            notusers <EmailAddressList>|
+            regex <REMatchPattern>|
+            notregex <REMatchPattern>]
         [copysubfolders [<Boolean>]] [foldernamematchpattern <REMatchPattern>]
         [copysubshortcuts [<Boolean>]] [shortcutnamematchpattern <REMatchPattern>]
         [duplicatefiles overwriteolder|overwriteall|duplicatename|uniquename|skip]
@@ -114,6 +134,7 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         [copysheetprotectedrangesinheritedpermissions [<Boolean>]]
         [copysheetprotectedrangesnoninheritedpermissions [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
         [sendemailifrequired [<Boolean>]]
         [verifyorganizer [<Boolean>]]
@@ -169,6 +190,7 @@ By default, GAM displays a message referencing files and folders not selected fo
 You can specify restrictions on the MIME types to be copied.
 * `filemimetypes <MimeTypeList>` - Copy sub files with the specified MIME types
 * `filemimetypes not <MimeTypeList>` - Copy sub files with MIME types other than those specified 
+* `filemimetypes category <MimeTypeNameList>` - Copy sub files with the specified MIME type categories
 
 ### By default, when copying sub files, folders and shortcuts, all are copied.
 You can specify `<REMatchPattern>` patterns that limit the items copied based on their name.
@@ -177,9 +199,13 @@ You can specify `<REMatchPattern>` patterns that limit the items copied based on
 * `shortcutnamematchpattern <REMatchPattern>` - Only shortcuts whose name matches `<REMatchPattern>` are copied
 
 ### By default, when copying sub files, all files, regardless of ownership, are copied.
-* `copysubfilesownedby any` - All files, regardless of ownership, are copied.
+* `copysubfilesownedby any` - All files, regardless of ownership, are copied; this is the default.
 * `copysubfilesownedby me` - Only files owned by `<UserTypeEntity>`  are copied.
 * `copysubfilesownedby others` - Only files not owned by `<UserTypeEntity>`  are copied.
+* `copysubfilesownedby users <EmailAddressList>` - Only files owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby notusers <EmailAddressList>` - Only files not owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby regex <REMatchPattern>` - Only files owned by users whose email addresses match `<REMatchPattern>` are copied.
+* `copysubfilesownedby notregex <REMatchPattern>` - Only files owned by users whose email addresses do not match `<REMatchPattern>` are copied.
 
 ### Specify a new name for the file/folder
 * `newfilename <DriveFileName>` - The copied file/folder will be named `<DriveFileName>`
@@ -313,8 +339,14 @@ When `excludepermissionsfromdomains <DomainNameList>` is specified, any ACL that
 
 When `includepermissionsfromdomains <DomainNameList>` is specified, only ACLs that reference a domain in `<DomainNameList>` will be copied.
 
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>` will be modified
+to reference the second `<EmailAddress>` when copied; the original ACL is not modified. The option can be repeated if multiple email addresses are to be mapped.
+
+Bulk permission email address mapping can be specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
 When `mappermissionsdomain <DomainName> <DomainName>` is specified, any ACL that references the first `<DomainName>` will be modified
-to reference the second `<DomainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to me mapped.
+to reference the second `<DomainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to be mapped.
 
 When copying an ACL that references a non Google account, an error is generated unless an email is sent to the account;
 by default, no email notifications are sent. The `sendemailifrequired` options instructs GAM to send an email notification in this case.
@@ -542,8 +574,8 @@ gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileNam
         [copysubfolderinheritedpermissions [<Boolean>]]
         [copysubfoldernoninheritedpermissions never|always|syncallfolders|syncupdatedfolders]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
-        [updatefilepermissions [<Boolean>]]
         [retainsourcefolders [<Boolean>]]
         [sendemailifrequired [<Boolean>]]
         [verifyorganizer [<Boolean>]]
@@ -666,8 +698,14 @@ When `excludepermissionsfromdomains <DomainNameList>` is specified, any ACL that
 
 When `includepermissionsfromdomains <DomainNameList>` is specified, only ACLs that reference a domain in `<DomainNameList>` will be copied.
 
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>` will be modified
+to reference the second `<EmailAddress>` when copied; the original ACL is not modified. The option can be repeated if multiple email addresses are to be mapped.
+
+Bulk permission email address mapping can ge specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
 When `mappermissionsdomain <DomainName> <DomainName>` is specified, any ACL that references the first `<DomainName>` will be modified
-to reference the second `<DomainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to me mapped.
+to reference the second `<DomainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to be mapped.
 
 When copying an ACL that references a non Google account, an error is generated unless an email is sent to the account;
 by default, no email notifications are sent. The `sendemailifrequired` options instructs GAM to send an email notification in this case.
@@ -684,8 +722,14 @@ When `excludepermissionsfromdomains <DomainNameList>` is specified, any ACL that
 
 When `includepermissionsfromdomains <DomainNameList>` is specified, any ACLs that references a domain not in `<DomainNameList>` will be removed.
 
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>` will be removed;
+a new ACL with the same properties referencing the second `<EmailAddess>` will be created. The option can be repeated if multiple domain names are to be mapped.
+
+Bulk email address mapping can ge specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
 When `mappermissionsdomain <DomainName> <DomainName>` is specified, any ACL that references the first `<DomainName>` will be removed;
-a new ACL with the same properties referencing the second `<DomainName>` will be created. The option can be repeated if multiple domain names are to me mapped.
+a new ACL with the same properties referencing the second `<DomainName>` will be created. The option can be repeated if multiple domain names are to be mapped.
 
 When creating an ACL that references a non Google account, an error is generated unless an email is sent to the account;
 by default, no email notifications are sent. The `sendemailifrequired` options instructs GAM to send an email notification in this case.

wiki/Users-Drive-Files-Display.md

@@ -752,7 +752,7 @@ The option `showlastmodification` displays the following fields:
 `lastModifiedFileId,lastModifiedFileName,lastModifiedFileMimeType,lastModifiedFilePath,lastModifyingUser,lastModifiedTime`;
 these are for the most recently modified file.
 
-For print filecouts, add additional columns of data from the command line to the output:
+For print filecounts, add additional columns of data from the command line to the output:
 * `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
 
 See [Select files for Display file counts, list, tree](#select-files-for-display-file-counts-list-tree)
@@ -880,11 +880,11 @@ Print or show the share type counts of a user's files. These fields are displaye
 ```
 gam <UserTypeEntity> print filesharecounts [todrive <ToDriveAttribute>*]
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 gam <UserTypeEntity> show filesharecounts
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 ```
 
@@ -892,8 +892,10 @@ By default, print|show filesharecounts displays share type counts of all files o
 
 Use the `excludetrashed` option to suppress counting files in the trash.
 
-By default, `internaldomains <DomainNameList>` defaults to your primary domain; if you have other domains that
-you consider internal, list all of them in `<DomainNameList>`.
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
 By default, share type counts for individual users are displayed; the `summary` option offers alternatives
 that can display a summarization of share type counts across all users specified in the command.
@@ -1103,7 +1105,7 @@ gam <UserTypeEntity> print|show filelist [todrive <ToDriveAttribute>*]
         [showparentsidsaslist] [showpermissionslast]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])* [delimiter <Character>]
         [stripcrsfromname]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 ```
 By default, `print filelist` displays all files owned by the specified [`<UserTypeEntity>`](https://github.com/GAM-team/GAM/wiki/Collections-of-Users)
@@ -1214,7 +1216,6 @@ If no query or select is performed, use these options to get file path informati
 * `filepath|fullpath` - For files and folders, display the full path(s) to them starting at the root (My Drive)
 * `addpathstojson` - When this option and `formatjson` are specified, the path information will be included in the
 JSON data rather than as additional columns
-* `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
 
 When used with `filepath` or `fullpath`, `showdepth` will display a `depth` column.
 Files/folders directly in `My Drive` are at depth 0, the depth increases by 1
@@ -1308,9 +1309,15 @@ Use the `countsrowfilter` option to have GAM to apply `config csv_output_row_fil
 The `stripcrsfromname` option strips nulls, carriage returns and linefeeds from drive file names.
 This option is special purpose and will not generally be used.
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Users-Drive-Permissions.md

@@ -234,7 +234,6 @@ The option `updatesheetprotectedranges` only applies to items in `<DriveFileEnti
     * ACLs with role reader or commenter will be removed from existing protected ranges
     * ACLs with role writer or higher will be added to existing protected ranges
 
-`
 `enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
 the ability to update inherited ACLs.
 * False - Inherited ACLs can be updated
@@ -261,7 +260,7 @@ The option `updatesheetprotectedranges` only applies to items in `<DriveFileEnti
     * ACLs with any role will be removed from existing protected ranges
 
 `enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
-the ability to delete delete inherited ACLs.
+the ability to delete inherited ACLs.
 * False - Inherited ACLs can be deleted
 * True = Inherited ACLs can not be deleted
 
@@ -308,7 +307,7 @@ gam <UserTypeEntity> delete permissions <DriveFileEntity> <DriveFilePermissionID
         [enforceexpansiveaccess [<Boolean>]]
 ```
 `enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
-the ability to delete delete inherited ACLs.
+the ability to delete inherited ACLs.
 * False - Inherited ACLs can be deleted
 * True = Inherited ACLs can not be deleted
 

wiki/Users-Gmail-Messages-Threads.md

@@ -589,9 +589,9 @@ gam <UserTypeEntity> show messages|threads
          [labelids <LabelIDList>]
          [quick|notquick] [max_to_show <Number>] [includespamtrash])|(ids <MessageIDEntity>)
         [labelmatchpattern <REMatchPattern>] [sendermatchpattern <REMatchPattern>]
-        [countsonly|positivecountsonly] [useronly]
+        [countsonly|positivecountsonly]
         [headers all|<SMTPHeaderList>] [dateheaderformat iso|rfc2822|<String>] [dateheaderconverttimezone [<Boolean>]]
-        [showlabels] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
+        [showlabels] [useronly] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
         [maxmessagesperthread <Number>]
         [showattachments [attachmentnamepattern <REMatchPattern>>] [noshowtextplain]]
         [saveattachments [attachmentnamepattern <REMatchPattern>>]]
@@ -601,12 +601,13 @@ gam <UserTypeEntity> print messages|threads [todrive <ToDriveAttribute>*]
          [labelids <LabelIDList>]
          [quick|notquick] [max_to_print <Number>] [includespamtrash])|(ids <MessageIDEntity>)
         [labelmatchpattern <REMatchPattern>] [sendermatchpattern <REMatchPattern>]
-        [countsonly|positivecountsonly] [useronly]
+        [countsonly|positivecountsonly]
         [headers all|<SMTPHeaderList>] [dateheaderformat iso|rfc2822|<String>] [dateheaderconverttimezone [<Boolean>]]
-        [showlabels] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
+        [showlabels] [useronly] [delimiter <Character>] [showbody] [showhtml] [showdate] [showsize] [showsnippet]
         [maxmessagesperthread <Number>]
         [showattachments [attachmentnamepattern <REMatchPattern>>]]
         [convertcrnl]
+        (addcsvdata <FieldName> <String>)*
 ```
 ## Display all messages
 By default, Gam displays all messages.
@@ -692,6 +693,7 @@ The `dateheaderconverttimezone [<Boolean>]>` option converts `<SMTPDateHeader>`
 ## Print only options
 These options are valid with `print`.
 * `convertcrnl` - In the message body, convert carriage returns to `\r` and newlines to `\n`; the default value is `csv_output_convert_cr_nl` from `gam.cfg`.
+* `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
 
 By default, message attachment information is not displayed.
 * `showattachments` - Display attachment filename, MIME type and size

wiki/Users-Keep-Notes.md

@@ -40,12 +40,12 @@ gam user user@domain.com update serviceaccount
 <JSONData> ::=
         (json [charset <Charset>] <String>) | (json file <FileName> [charset <Charset>]) |
 
-<NoteContent> ::=
-        ((text <String>)|
-         (textfile <FileName> [charset <Charset>])|
-         (gdoc <UserGoogleDoc>)|
-         (gcsdoc <StorageBucketObjectName>)|
-         <JSONData>)
+<KeepNoteContent> ::=
+        (text <String>)|
+        (textfile <FileName> [charset <Charset>])|
+        (gdoc <UserGoogleDoc>)|
+        (gcsdoc <StorageBucketObjectName>)|
+        <JSONData>
 
 <NotesName> ::= notes/<String>
 <NotesNameList> ::= "<NotesName>(,<NotesName)*"
@@ -84,11 +84,11 @@ you will use wherever `<NotesName>` is required.
 ```
 gam <UserTypeEntity> create note [title <String>]
         [missingtextvalue <String>]
-        <NoteContent>
+        <KeepNoteContent>
         [copyacls [copyowneraswriter]]
         [compact|formatjson|nodetails]
 ```
-`<NoteContent>` is the note text, there are four ways to specify it:
+`<KeepNoteContent>` is the note text, there are four ways to specify it:
 * `message|textmessage|htmlmessage <String>` - Use `<String>` as the note text
 * `file|htmlfile <FileName> [charset <Charset>]` - Read the note text from `<FileName>`
 * `gdoc|ghtml <UserGoogleDoc>` - Read the note text from `<UserGoogleDoc>`

wiki/Users-Photo.md

@@ -20,7 +20,7 @@
 ```
 gam <UserTypeEntity> update photo
 ```
-* The default file is named `#email#.#ext#` in the current working directory.
+* The default file is named `#email#.jpg` in the current working directory.
     * `#email#` will be replaced by the user's full email address
 
 ## Upload a user's photo specifying file name

wiki/Users-Shared-Drives.md

@@ -15,6 +15,7 @@
 - [Display Shared Drive Counts](#display-shared-drive-counts)
 - [Display Shared Drive Organizers](#display-shared-drive-organizers)
 - [Manage Shared Drive access](#manage-shared-drive-access)
+- [Transfer Shared Drive access](#transfer-shared-drive-access)
 - [Display Shared Drive access](#display-shared-drive-access)
   - [Display Shared Drive access for specific Shared Drives](#display-shared-drive-access-for-specific-shared-drives)
   - [Display Shared Drive access for selected Shared Drives](#display-shared-drive-access-for-selected-shared-drives)
@@ -72,6 +73,15 @@
 <ColorValue> ::= <ColorName>|<ColorHex>
 ```
 ```
+<CSVFileInput> ::=
+        ((<FileName> [charset <Charset>] )|
+         (gsheet <UserGoogleSheet>)|
+         (gdoc <UserGoogleDoc>)|
+         (gcscsv <StorageBucketObjectName>)|
+         (gcsdoc <StorageBucketObjectName>))
+        [warnifnodata] [columndelimiter <Character>] [noescapechar <Boolean>] [quotechar <Character>]
+        [endcsv|(fields <FieldNameList>)]
+
 <JSONData> ::= (json [charset <Charset>] <String>) | (json file <FileName> [charset <Charset>]) |
 
 <OrganizerType> ::= user|group
@@ -86,7 +96,8 @@
 <REMatchPattern> ::= <RegularExpression>
 <RESearchPattern> ::= <RegularExpression>
 <RESubstitution> ::= <String>>
-
+```
+```
 <DriveFileOrderByFieldName> ::=
         createddate|createdtime|
         folder|
@@ -516,6 +527,40 @@ When adding permissions from JSON data, permissions with `deleted` true are neve
 
 When deleting permissions from JSON data, permissions with role `owner` true are never processed.
 
+## Transfer Shared Drive access
+These commands are used to transfer ACLs from one Shared Drive to another.
+* `copy` - Copy all ACLs from the source Shared Drive to the target Shared Drive. The role of an existing ACL in the target Shared Drive will never be reduced.
+* `sync` - Add/delete/update ACLs in the target Shared Drive to match those in the source Shared Drive.
+
+* `adminaccess|asadmin` specified - All Shared Drives must be in the same workspace as `<UserTypeEntity>`.
+* `adminaccess|asadmin` not specified - Shared Drives can be in separate workspaces if `<UserTypeEntity>` in a manager of all of them.
+```
+gam <UserTypeEntity> copy shareddriveacls <SharedDriveEntity> to <SharedDriveEntity>
+        [showpermissionsmessages [<Boolean>]]
+        [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
+        (mappermissionsdomain <DomainName> <DomainName>)*
+        [adminaccess|asadmin]
+gam <UserTypeEntity> sync shareddriveacls <SharedDriveEntity> with <SharedDriveEntity>
+        [showpermissionsmessages [<Boolean>]]
+        [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
+        (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
+        (mappermissionsdomain <DomainName> <DomainName>)*
+        [adminaccess|asadmin]
+```
+When `excludepermissionsfromdomains <DomainNameList>` is specified, any ACL that references a domain in `<DomainNameList>` will not be copied.
+
+When `includepermissionsfromdomains <DomainNameList>` is specified, only ACLs that reference a domain in `<DomainNameList>` will be copied.
+
+When `mappermissionsemail <EmailAddress> <EmailAddress>` is specifed, an ACL that references the first `<EmailAddress>` will be modified
+to reference the second `<EmailAddress>` when copied; the original ACL is not modified. The option can be repeated if multiple email addresses are to be mapped.
+
+Bulk permission email address mapping can be specified with `mappermissionsemailfile <CSVFileInput> endcsv`.
+`<CSVFileInput>` must include these columns: `sourceEmail` and `destinationEmail`.
+
+When `mappermissionsdomain <DomainName> <DomainName>` is specifed, any ACL that references the first `<DomainName>` will be modified
+to reference the second `<DomainName>` when copied; the original ACL is not modified. The option can be repeated if multiple domain names are to be mapped.
+
 ## Display Shared Drive access
 
 These commands are used to display the ACLs on Shared Drives themselves, not the files/folders on the Shared Drives.

wiki/Users.md

@@ -231,6 +231,11 @@ When specifying a `<UserMultiAttribute>` you have to specify all instances; ther
 
 You can remove all instances of a `<UserMultiAttribute>` with `<UserClearAttribute>`.
 ```
+<UserNoteContent> ::=
+        <String>|
+        (file|textfile|htmlfile <FileName> [charset <Charset>])|
+        (gdoc|ghtml <UserGoogleDoc>)
+         
 <UserBasicAttribute> ::=
         (archive|archived <Boolean>)|
         (changepassword|changepasswordatnextlogin <Boolean>)|
@@ -244,9 +249,7 @@ You can remove all instances of a `<UserMultiAttribute>` with `<UserClearAttribu
         (ipwhitelisted <Boolean>)|
         (language clear|<LanguageList>)|
         (lastname|familyname <String>)|
-        (note clear|([text_html|text_plain] <String>|
-                                            (file|htmlfile <FileName> [charset <Charset>])|
-                                            (gdoc|ghtml <UserGoogleDoc>)))|
+        (note clear|([text_html|text_plain] <UserNoteContent>))|
         (org|ou|orgunitpath <OrgUnitPath>|<OrgUnitID>)
         (password (random [<Integer>])|(uniquerandom [<Integer>])|
                   blocklogin|
@@ -1055,7 +1058,7 @@ gam print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 ```
 
 By default, users in all domains in the account are selected; these options allow selection of subsets of users:
@@ -1081,7 +1084,7 @@ gam print users [todrive <ToDriveAttribute>*] select <UserTypeEntity>
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 
 gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         [orderby <UserOrderByFieldName> [ascending|descending]]
@@ -1095,7 +1098,7 @@ gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 ```
 
 By default, Gam gets no group membership information for each user. The `groups` and `groupsincolumns`
@@ -1164,6 +1167,9 @@ Add additional columns of data from the command line to the output
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 When you perform `gam print users` with the following `todrive` options to update a sheet within a Google Sheets file:
 `tdfileid <DriveFileID> tdsheet <SheetEntity> tdupdatesheet`
 and your data includes international phone numbers that start with a plus sign, Google Sheets generates a `Formula parse error`

wiki/Using-GAM7-with-a-YubiKey.md

@@ -29,23 +29,32 @@ No, because the YubiKey generated the private key it cannot be digitally exporte
 When using domain-wide delegation with GAM7, the service account and anyone possessing the service account private key oauth2service.json file has access to the Gmail, Drive and Calendar data of ALL Workspace users in your domain. For this reason, whether using a YubiKey or not, you should take strong measures to protect the service account private key.
 
 ## Setup Steps
-1 .Upgrade to the [latest version of GAM7](https://github.com/GAM-team/GAM/wiki/How-to-Update-GAM7).
-2. **If you are using a new YubiKey or don't care about the PIV app data on the YubiKey**
-    1. Tell GAM7 to reset and configure the PIV app data on the YubiKey. This wipes all existing keys and configuration and then configures a private key and PIN for GAM7.
+
+1. Upgrade to the [latest version of GAM7](https://github.com/GAM-team/GAM/wiki/How-to-Update-GAM7).
+
+2. If you are using a new YubiKey or don't care about the PIV app data on the YubiKey:
+   
+    a. Tell GAM7 to reset and configure the PIV app data on the YubiKey. This wipes all existing keys and configuration and then configures a private key and PIN for GAM7.
+
       * Single YubiKey - `gam yubikey reset_piv`
+
       * Multiple YubiKeys - `gam yubikey reset_piv yubikeyserialnumber <Number>`
-    2. During the PIV reset, GAM7 will print out a PIN for the private key, record this key.
-4. **If you are already using the YubiKey and wish to preserve the PIV app data and keys**
-    1. You need to configure one of the PIV slots for a private key GAM7 can use.
+
+    b. During the PIV reset, GAM7 will print out a PIN for the private key, record this key.
+
+3. OR if you are already using the YubiKey and wish to preserve the PIV app data and keys
+
+    a. You need to configure one of the PIV slots for a private key GAM7 can use.
       * [ykman piv keys generate](https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Commands.html#ykman-piv-keys-options-command-args)
         `ykman piv keys generate -P <Text> --pin-policy ALWAYS --touch-policy NEVER --algorithm RSA2048 9a new_pubkey.txt`
       * Use `9a` for the `AUTHENTICATION` slot, `9c` for the `SIGNATURE` slot
-    2. You need to generate a certificate for that slot.
+
+    b. You need to generate a certificate for that slot.
       * [ykman piv certificates generate](https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Commands.html#ykman-piv-certificates-generate-options-slot-public-key)
         `ykman piv certificates generate -P <Text> --subject "GAM Service Account" -d 36500 9a new_pubkey.txt`
       * Use `9a` for the `AUTHENTICATION` slot, `9c` for the `SIGNATURE` slot
 
-5. Now that you have a private key on your YubiKey, tell GAM7 to use that instead of the private_key stored in oauth2service.json. We can do that by rotating the key:
+4. Now that you have a private key on your YubiKey, tell GAM7 to use that instead of the private_key stored in oauth2service.json. We can do that by rotating the key:
 ```
 copy oauth2service.json to oauth2service.save
 gam create sakey yubikey yubikey_pin yubikey_slot AUTHENTICATION|SIGNATURE
@@ -58,10 +67,10 @@ copy oauth2service.json to oauth2service.yk
 copy oauth2service.save to oauth2service.json
 ```
 
-6. Now you should be able to run GAM7 commands like:
+5. Now you should be able to run GAM7 commands like:
 ```
 gam user admin@example.com check serviceaccount
 ```
 and see the YubiKey lights flash as the YubiKey interacts with GAM7 to sign the GAM7 authentication requests. If you look at the oauth2service.json file, you'll see it contains some new fields like yubikey_serial and yubikey_pin but no longer contains the private_key field where GAM7 would normally store the private key data.
 
-7. As a last step, since YubiKey-stored private keys do not need to be and should not be rotated, you can remove the service account's permissions to change it's own key. Navigate to the [Cloud Console](https://console.cloud.google.com/iam-admin/serviceaccounts) select the correct project and service account and on the Permissions tab, edit and remove the "Service Account Key Admin" permission that the service account has to itself.
+6. As a last step, since YubiKey-stored private keys do not need to be and should not be rotated, you can remove the service account's permissions to change it's own key. Navigate to the [Cloud Console](https://console.cloud.google.com/iam-admin/serviceaccounts) select the correct project and service account and on the Permissions tab, edit and remove the "Service Account Key Admin" permission that the service account has to itself.

wiki/Version-and-Help.md

@@ -3,22 +3,22 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.28.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.02 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.0 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
-Time: 2023-06-02T21:10:00-07:00
+Time: 2025-12-23T13:57:00-08:00
 ```
 
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.28.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.02 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.0 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Your system time differs from www.googleapis.com by less than 1 second
@@ -27,13 +27,13 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.28.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.02 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.0 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
-Time: 2023-06-02T21:10:00-07:00
+Time: 2025-12-23T13:57:00-08:00
 Your system time differs from admin.googleapis.com by less than 1 second
 OpenSSL 3.5.3 16 Sep 2025
 arrow 1.3.0
@@ -68,7 +68,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/Admin/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.28.01
+   Latest: 7.32.02
 echo $?
 1
 ```
@@ -76,7 +76,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.28.01
+7.32.02
 ```
 In Linux/MacOS you can do:
 ```
@@ -86,13 +86,13 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.28.01 - https://github.com/GAM-team/GAM
+GAM 7.32.02 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.0 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
-Time: 2023-06-02T21:10:00-07:00
+Time: 2025-12-23T13:57:00-08:00
 Help: Syntax in file /Users/Admin/bin/gam7/GamCommands.txt
 Help: Documentation is at https://github.com/GAM-team/GAM/wiki
 ```

wiki/_Sidebar.md

@@ -33,6 +33,7 @@ Notes and Information
 * [Questions? Visit the GAM Discussion Forum](https://groups.google.com/forum/#!forum/google-apps-manager)
 * [GAM Public Chat Room](GAM-Public-Chat-Room)
 * [Scripts](Scripts)
+* [Code Wiki](https://codewiki.google/github.com/gam-team/gam)
 * [Other Resources](Other-Resources)
 * [Drive REST API v3](Drive-REST-API-v3)
 * [BNF Syntax](BNF-Syntax)

wiki/foo.lst

@@ -1 +0,0 @@
-ChromeOS-Devices.md Classroom-Courses.md Classroom-Membership.md Classroom-StudentGroups.md Cloud-Identity-Devices.md Cloud-Identity-Groups.md Domains.md GamUpdates.md Groups.md Mobile-Devices.md Organizational-Units.md Resources.md Shared-Drives.md Users-Shared-Drives.md Users.md

wiki/gam.cfg.md

@@ -1,7 +1,9 @@
 # GAM Configuration
 - [Introduction](#introduction)
 - [Variables](#variables)
+- [Set configuration variables](#set-configuration-variables)
 - [Multiple Computers](#multiple-computers)
+- [Separate Staff-Student Domains](#separate-staff-student-domains)
 - [Multiple Customers and Domains](#multiple-customers-and-domains)
 - [Multiple Users-Projects on One Computer](#multiple-users-projects-on-one-computer)
 
@@ -275,7 +277,8 @@ csv_output_row_limit
         Default: 0
 csv_output_sort_headers
         A list of column headers that causes GAM to sort CSV output rows by those headers.
-        The column headers are case insensitive and if column header does not appear in the CSV output, it is ignored.
+        The column headers are case insensitive and if column header does not appear in the CSV output,
+        it is ignored.
         Default: Blank
 csv_output_subfield_delimiter
         Character used to delimit fields and subfields in headers when writing CSV files;
@@ -289,8 +292,6 @@ csv_output_timestamp_column
 csv_output_users_audit
         Gam print commands that print objects belonging to users
         don't print rows for users that don't have any of the objects.
-        The objects are: calendars, calendar ACLs, calendar events, delegates, filters,
-        forwarding addresses, sendas addresses, S/MIME certificates and tokens.
         When csv_output_users_audit is true, a placeholder row will be output with the
         user's email address; these rows will useful for auditing purposes only,
         they can not be successfuly used in a gam csv command.
@@ -316,7 +317,7 @@ domain
         Default: Blank
         Environment variable: GA_DOMAIN
 drive_dir
-        Directory for get drivefile and CSV files
+        Output directory for files with non-absolute file names.
         Default: ~/Downloads
         Environment variable: GAMDRIVEDIR
 drive_max_results
@@ -342,7 +343,8 @@ enable_dasa
         customer_id may not be set to my_customer
         Signal file: OldGamPath/enabledasa.txt
 enforce_expansive_access
-        The default value for option `enforceexpansiveaccess` in all commands that delete or update drive file ACLs/permissions.
+        The default value for option `enforceexpansiveaccess` in all commands that delete or update
+        drive file ACLs/permissions.
         gam <UserTypeEntity> delete permissions
         gam <UserTypeEntity> delete drivefileacl
         gam <UserTypeEntity> update drivefileacl
@@ -364,8 +366,13 @@ gmail_cse_incert_dir
         Directory for the S/MIME certificate files used by Gmail Client Side Encryption.
         Default: Blank
 gmail_cse_inkey_dir
-        Directory for the Key Access Control List (KACL) wrapped private key data files used by Gmail Client Side Encryption.
+        Directory for the Key Access Control List (KACL) wrapped private key data files used by
+        Gmail Client Side Encryption.
         Default: Blank
+input_dir
+        Input directory for files with non-absolute file names.
+	The default 
+        Default: .
 inter_batch_wait
         When processing items in batches, how many seconds should GAM wait between batches
         Default: 0
@@ -377,7 +384,8 @@ license_max_results
         Range: 10 - 1000
 license_skus
         A comma separated list of license SKUs; when getting licenses, only these SKUs will be processed.
-        Each item in the list can be a <SKUID> which will be validated or <ProductID>/<SKUID> which will not
+        Each item in the list can be a <SKUID> which will be validated or
+        a <ProductID>/<SKUID> which will not be validated.
         Default: Blank
 meet_v2_beta
         Enable/disable use of Meet API v2 beta for additional Chat Space parameters.
@@ -455,6 +463,10 @@ oauth2_txt
         Path to oauth2.txt
         Default: GamConfigDir/oauth2.txt
         Environment variable: OAUTHFILE
+oauth2_txt_lock_mode
+        Allowed values: 644, 664, 666
+        File permissions for oauth2.txt.lock
+        Default: 644
 oauth2service_json
         Path to oauth2service.json
         Default: GamConfigDir/oauth2service.json
@@ -495,8 +507,9 @@ print_cros_ous_and_children
         This allows predefining the list of org units so they don't have to be specified in each command.
         Default: Blank
 process_wait_limit
-        When processing batch/CSV files, how long (in seconds) GAM should wait for all batch|csv processes to complete
-        after all have been started. If the limit is reached, GAM terminates any remaining processes.
+        When processing batch/CSV files, how long (in seconds) GAM should wait for all
+        batch|csv processes to complete after all have been started.
+        If the limit is reached, GAM terminates any remaining processes.
         Default: 0: no limit
         Range: 0 - Unlimited
 quick_cros_move
@@ -564,10 +577,10 @@ timezone
         to your local timezone. If you are running GAM on a remote computer or on a
         cloud shell, "local" will mean the time at the remote/cloud shell computer,
         not your location, Use "+|-hh:mm" to specify the timezone at your location.
-	Starting with version 7.21.00 you can use a timezone name.
+	Starting with version 7.21.00 you can use a timezone name; the names are case sensitive.
         See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
         Default: utc
-        Range: utc|z|local|(+|-hh:mm)I<ValidTimezoneName>
+        Range: utc|z|local|(+|-hh:mm)|<ValidTimezoneName>
 tls_max_version
         Allowed values: '', tlsv1_2, tlsv1.2, tlsv1_3, tlsv1.3
         The maximum TLS version to use in https connections
@@ -577,10 +590,12 @@ tls_min_version
         The minimum TLS version to use in https connections
         Default: ''
 todrive_clearfilter
-        Enable/disable clearing the spreadsheet basic filter when uploading data to an existing sheet in an existing file.
+        Enable/disable clearing the spreadsheet basic filter when uploading data to an existing sheet in
+        an existing file.
         Default: False
 todrive_clientaccess
-        Enable/disable use of client access rather than service account access when uploading files with todrive
+        Enable/disable use of client access rather than service account access when uploading files
+        with todrive
         Default: False
 todrive_conversion
         Enable/disable conversion of CSV files to Google Sheets when todrive is specified
@@ -621,7 +636,7 @@ todrive_timeformat
         Default: '' which selects an ISO format timestamp
         Example: %Y-%m-%dT%H:%M:%S will display as 2020-07-06T17:48:54
 todrive_timezone
-        The Spreadsheet settings Timezone value.
+        The Spreadsheet settings Timezone value; the values are case sensitive.
         See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
         Default: ''
 todrive_upload_nodata
@@ -631,8 +646,9 @@ todrive_user
         Email address of user to receive CSV files when todrive is specified
         Default: '' which becomes admin user in admin_email or address from oauth2.txt
 truncate_client_id
-        Prior to version 6.74.00, GAM stripped '.apps.googleusercontent.com' from the client_id in oauth2.txt
-        and passed the truncated value in API calls; this is no longer performed unless truncate_client_id is true
+        Prior to version 6.74.00, GAM stripped '.apps.googleusercontent.com' from the client_id
+        in oauth2.txt and passed the truncated value in API calls; this is no longer performed
+        unless truncate_client_id is true
         Default: False
 update_cros_ou_with_id
         Update the OU of a Chromebook with the OU ID rather than the OU path.
@@ -670,7 +686,7 @@ user_service_account_access_only
 ```
 This is sample output:
 ```
-$gam select default verify.
+$gam select default verify
 Config File: /Users/admin/.gam/gam.cfg, Initialized
 Section: DEFAULT
   activity_max_results = 100
@@ -797,6 +813,33 @@ Section: DEFAULT
   user_service_account_access_only = false
 ```
 
+## Set configuration variables
+You can set variables in gam.cfg with an editor or from the command line with GAM.
+
+```
+<Config> ::=
+        config (<VariableName> [=] <Value>)* [save] [verify [variables <RESearchPattern>]]
+```
+- `<VariableName> [=] <Value>`
+  - Set `<VariableName> = <Value>` in the current section
+  - All `<VariableNames>` except section are allowed.
+  - The `=` is optional but must be surrounded by spaces if included.
+- `save`
+  - Write configuration data to gam.cfg
+- `verify`
+  - Print the variable values for the current section
+  - Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
+  - Values are determined in this order: Current section, DEFAULT section, Program default
+
+You can prefix `<Config>` with `<Select>` to set a variable in a particular section.
+* `select default <Config>` - Set a variable in the `DEFAULT` section
+* `select xyz <Config>` - Set a variable in the `xyz` section
+
+For example, to set yiur workspace Customer ID and domain name:
+```
+gam config customer_id C0123abc domain mydomain.org save
+```
+
 ## Multiple Computers
 You can install GAM on multiple computers, all using the same project. After installing GAM on your
 initial computer, follow these quidelines.
@@ -816,6 +859,26 @@ Edit `gam.cfg` on the other computer
     * config_dir
     * drive_dir
 
+## Separate Staff-Student Domains
+Suppose you have a single workspace with separate staff and student domains; e.g., school.org and students.school.org.
+You can simplifiy typing email addresses by making two sections.
+
+```
+[DEFAULT]
+customer_id = C1234567
+[staff]
+domain = school.org
+[students]
+domain = students.school.org
+```
+To issue commands about staff users, do: `gam config staff save`
+Subsequent commands can omit `@school.org` from email addresses, GAM will supply `@school.org`.
+
+To issue commands about student users, do: `gam config students save`
+Subsequent commands can omit `@students.school.org` from email addresses, GAM will supply `@students.school.org`.
+
+You can always type a complete email address if desired.
+
 ## Multiple Customers and Domains
 There are four arguments to GAM that should simplify how you use GAM with multiple clients/domains.
 Each client/domain will have a section in gam.cfg that sets the values specific to it.
@@ -824,7 +887,7 @@ it's how you quickly switch from from one client to another.
 
 The arguments are optional, must appear in this order and must be the first arguments before any other GAM arguments.
 ```
-select <Section> [save] [verify]
+select <Section> [save] [verify [variables <RESearchPattern>]]
         Use <Section> from gam.cfg for the current GAM command.
         <Section> is case-sensitive except for DEFAULT which is case-insensitive.
     save
@@ -832,6 +895,7 @@ select <Section> [save] [verify]
         Write configuration data to gam.cfg
     verify
         Print the variable values for the current section
+        Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
         Values are determined in this order: Current section, DEFAULT section, Program default
 ```
 Display all of the sections in gam.cfg and mark the currently selected section with a *.
@@ -840,7 +904,7 @@ showsections
 ```
 The config argument is used to set selected variables in gam.cfg via the command line.
 ```
-config [<VariableName> [=] <Value>]* [save] [verify]
+config [<VariableName> [=] <Value>]* [save] [verify [variables <RESearchPattern>]]
     <VariableName> [=] <Value>
         Set <VariableName> = <Value> in the current section
         All <VariableNames> except section are allowed.
@@ -849,6 +913,7 @@ config [<VariableName> [=] <Value>]* [save] [verify]
         Write configuration data to gam.cfg
     verify
         Print the variable values for the current section
+        Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
         Values are determined in this order: Current section, DEFAULT section, Program default
 
 redirect csv <FileName> [multiprocess] [append] [noheader] [charset <Charset>] [columndelimiter <Character>]