Classroom student groups in general release

.github/workflows/build.yml

@@ -153,7 +153,7 @@ jobs:
         with:
           path: |
             cache.tar.xz
-          key: gam-${{ matrix.jid }}-20251218
+          key: gam-${{ matrix.jid }}-20260127
 
       - name: Untar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'

src/GamCommands.txt

@@ -386,6 +386,8 @@ If an item contains spaces, it should be surrounded by ".
 <ChatEmoji> ::= emojiname <ChatEmojiName> | customemojis/<String>
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMessage> ::= spaces/<String>/messages/<String>
+<ChatSection> ::= users/<String>/sections/<String> | sections/<String> | section <String>
+<ChatSectionItem> ::= users/<String>/sections/<String>/items/<String> | sections/<String>/items/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChromeProfilePermanentID> ::= <String>
@@ -512,6 +514,8 @@ If an item contains spaces, it should be surrounded by ".
 <MatterItem> ::= <UniqueID>|<String>
 <MatterState> ::= open|closed|deleted
 <MeetConferenceName> ::= conferenceRecords/<String>
+<MeetID> ::= <String>
+       Must match this Python Regular Expression: [a-z]{3}-[a-z]{4}-[a-z]{3}
 <MeetSpaceName> ::= spaces/<String> | <String>
 <MessageContent> ::=
         (message|textmessage|htmlmessage <String>)|
@@ -527,6 +531,7 @@ If an item contains spaces, it should be surrounded by ".
         (gdoc|ghtml <UserGoogleDoc>)|
         (gcsdoc|gcshtml <StorageBucketObjectName>)
 <NumberOfSeats> ::= <Number>
+<NumberRange> ::= <Number>|(<Number>/<Number>)
 <OrgUnitID> ::= id:<String>
 <OrgUnitPath> ::= /|(/<String>)+
 <OrgUnitItem> ::= <OrgUnitID>|<OrgUnitPath>
@@ -764,6 +769,7 @@ If an item contains spaces, it should be surrounded by ".
 <MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
 <NamespaceList> ::= "<Namespace>(,<Namespace>)*"
 <NotesNameList> ::= "<NotesName>(,<NotesName>)*"
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
 <OrgUnitList> ::= "<OrgUnitItem>(,<OrgUnitItem>)*"
 <OtherContactsResourceNameList> ::= "<OtherContactsResourceName>(,<OtherContactsResourceName>)*"
 <PeopleResourceNameList> ::= "<PeopleResourceName>(,<PeopleResourceName>)*"
@@ -1286,11 +1292,12 @@ Specify a collection of items by directly specifying them; the item type is dete
 
 ## Select a section from gam.cfg and process a GAM command using values from that section
 <Select> ::=
-        select <Section> [save] [verify]
+        select <Section> [save] [verify [variables <RESearchPattern>]]
 save
     Set section = <Section> in the [DEFAULT] section and write configuration data to gam.cfg
 verify
     Print the variable values for the selected section
+    Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
     Values are determined in this order: Selected section, DEFAULT section, Program default
 
 ## Display all of the sections in gam.cfg and mark the currently selected section with a *.
@@ -1314,7 +1321,7 @@ csv_input_row_drop_filter, csv_input_row_drop_filter_mode and csv_input_row_limi
 ## Set variables in gam.cfg.
 
 <Config> ::=
-        config (<VariableName> [=] <Value>)* [save] [verify]
+        config (<VariableName> [=] <Value>)* [save] [verify [variables <RESearchPattern>]]
 <VariableName> [=] <Value>
     Set <VariableName> = <Value> in the current section
     All <VariableNames> except section are allowed.
@@ -1323,6 +1330,7 @@ save
     Write configuration data to gam.cfg
 verify
     Print the variable values for the current section
+    Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`.
     Values are determined in this order: Current section, DEFAULT section, Program default
 
 ## Terminate processing of a CSV or batch file when one of the subprocesses returns a matching return code.
@@ -1821,8 +1829,10 @@ gam calendar|calendars <CalendarEntity> import event icaluid <iCalUID> <EventImp
 gam calendar|calendars <CalendarEntity> update events [<EventEntity>] [replacemode] <EventUpdateAttribute>+ [<EventNotificationAttribute>]
         [showdayofweek]
         [csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]
-gam calendar|calendars <CalendarEntity> delete events [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam calendar|calendars <CalendarEntity> purge events [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam calendar|calendars <CalendarEntity> delete events [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam calendar|calendars <CalendarEntity> purge events [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 gam calendar|calendars <CalendarEntity> wipe events
 gam calendar|calendars <CalendarEntity> move events [<EventEntity>] destination|to <CalendarItem> [<EventNotificationAttribute>]
 gam calendar|calendars <CalendarEntity> empty calendartrash
@@ -1945,7 +1955,7 @@ gam calendar|calendars <CalendarEntity> show events [<EventEntity>] <EventDispla
         [fields <EventFieldNameList>] [showdayofweek]
         [countsonly|formatjson]
 gam calendar|calendars <CalendarEntity> print events [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         (addcsvdata <FieldName> <String>)*
         [eventrowfilter]
         [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
@@ -2461,10 +2471,18 @@ gam <CrOSTypeEntity> update action <CrOSAction> [acknowledge_device_touch_requir
         wipe_users|
         take_a_screenshot
 
-gam issuecommand cros <CrOSEntity> command <CrOSCommand> [times_to_check_status <Integer>] [doit]
-gam <CrOSTypeEntity> issuecommand command <CrOSCommand> [times_to_check_status <Integer>] [doit]
-gam getcommand cros <CrOSEntity> commandid <CommandID> [times_to_check_status <Integer>]
-gam <CrOSTypeEntity> getcommand commandid <CommandID> [times_to_check_status <Integer>]
+gam issuecommand cros <CrOSEntity> command <CrOSCommand>
+        [times_to_check_status <Integer>] [doit]
+        [csv (addcsvdata <FieldName> <String>)*]
+gam <CrOSTypeEntity> issuecommand command <CrOSCommand>
+        [times_to_check_status <Integer>] [doit]
+        [csv (addcsvdata <FieldName> <String>)*]
+gam getcommand cros <CrOSEntity> commandid <CommandID>
+        [times_to_check_status <Integer>]
+        [csv (addcsvdata <FieldName> <String>)*]
+gam <CrOSTypeEntity> getcommand commandid <CommandID>
+        [times_to_check_status <Integer>]
+        [csv (addcsvdata <FieldName> <String>)*]
 
 <CrOSAttribute> ::=
         (asset|assetid|tag <String>)|
@@ -2577,7 +2595,7 @@ gam print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
@@ -2591,6 +2609,7 @@ gam print cros [todrive <ToDriveAttribute>*] select <CrOSTypeEntity>
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
@@ -2602,7 +2621,7 @@ gam <CrOSTypeEntity> print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
@@ -3980,7 +3999,7 @@ gam info group|groups <GroupEntity>
         [basic] <GroupFieldName>* [fields <GroupFieldNameList>] [nodeprecated]
         [ciallfields|(cifields <CIGroupFieldNameList>)]
         [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -3998,12 +4017,13 @@ gam print groups [todrive <ToDriveAttribute>*]
         [nodeprecated]
         [roles <GroupRoleList>]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [includederivedmembership]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>] [sortheaders]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
 
@@ -4034,7 +4054,8 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
+        [showallowexternal [<Boolean>]] [verifyallowexternal [<Boolean>]]
         [membernames] [showdeliverysettings]
         <MembersFieldName>* [fields <MembersFieldNameList>]
         [notsuspended|suspended] [notarchived|archived]
@@ -4045,8 +4066,9 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [(recursive [noduplicates])|includederivedmembership] [nogroupemail]
         [peoplelookup|(peoplelookupuser <EmailAddress>)]
         [unknownname <String>] [cachememberinfo [Boolean]]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
-`gam show group-members
+gam show group-members
         [([domain|domains <DomainNameEntity>] ([member|showownedby <EmailItem>]|[(query <QueryGroup>)|(queries <QueryGroupList>)]))|
          (group|group_ns|group_susp <GroupItem>)|
          (select <GroupEntity>)]
@@ -4054,7 +4076,7 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners] [depth <Number>]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -4122,7 +4144,7 @@ gam info cigroups <GroupEntity>
         [nosecurity|nosecuritysettings]
         [allfields|<CIGroupFieldName>*|(fields <CIGroupFieldNameList>)]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [formatjson]
@@ -4134,10 +4156,11 @@ gam print cigroups [todrive <ToDriveAttribute>*]
         [basic|allfields|(<CIGroupFieldName>* [fields <CIGroupFieldNameList>])]
         [roles <GroupRoleList>] [memberrestrictions]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
 
@@ -4161,11 +4184,14 @@ gam print cigroup-members [todrive <ToDriveAttribute>*]
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
+        [showallowexternal [<Boolean>]] [verifyallowexternal [<Boolean>]]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         <CIGroupMembersFieldName>* [fields <CIGroupMembersFieldNameList>]
         [minimal|basic|full]
         [(recursive [noduplicates]) | includederivedmembership] [nogroupemail]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 gam show cigroup-members
         [(cimember|ciowner <UserItem>)|(cigroup <GroupItem>)|(select <GroupEntity>)]
@@ -4173,6 +4199,7 @@ gam show cigroup-members
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [minimal|basic|full]
@@ -4301,7 +4328,7 @@ gam update deviceuserstate <DeviceUserEntity> [clientid <String>]
         [customid <String>] [assettags clear|<AssetTagList>]
         [compliantstate|compliancestate compliant|noncompliant] [managedstate clear|managed|unmanaged]
         [healthscore very_poor|poor|neutral|good|very_good] [scorereason clear|<String>]
-        (customvalue (bool|boolean <Boolean>)|(number <Integer>)|(string <String>))*
+        (customvalue clear|(bool|boolean <String> <Boolean>)|(number <String> <Integer>)|(string <String> <String>))*
 
 # Cloud Identity Policies
 
@@ -4626,10 +4653,12 @@ gam report usage customer [todrive <ToDriveAttribute>*]
 
 gam report <ActivityApplicationName> [todrive <ToDriveAttribute>*]
         [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
+        [userisactor]
         [([start <Time>] [end <Time>])|(range <Time> <Time>)|
          yesterday|today|thismonth|(previousmonths <Integer>)]
         [filter <String> (filtertime<String> <Time>)*]
         [event|events <EventNameList>] [ip <String>]
+        [gmaileventtypes <NumberRangeList>]
         [groupidfilter <String>] [resourcedetailsfilter <String>]
         [maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
         [countsonly [bydate|summary] [eventrowfilter]]
@@ -5935,7 +5964,7 @@ gam print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
 Print fields for specified users.
@@ -5952,7 +5981,7 @@ gam print users [todrive <ToDriveAttribute>*] select <UserTypeEntity>
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
 gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
@@ -5967,7 +5996,7 @@ gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
 The first column will always be primaryEmail; the remaining field names will be sorted if allfields, basic, full or sortheaders is specified;
@@ -6321,8 +6350,10 @@ gam <UserTypeEntity> import event <UserCalendarEntity> icaluid <iCalUID> <EventI
 gam <UserTypeEntity> update events <UserCalendarEntity> [<EventEntity>] [replacemode] <EventUpdateAttribute>+ [<EventNotificationAttribute>]
         [showdayofweek]
         [csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]]]
-gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>]
+#       [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 gam <UserTypeEntity> wipe events <UserCalendarEntity>
 gam <UserTypeEntity> move events <UserCalendarEntity> [<EventEntity>] destination|to <CalendarItem> [<EventNotificationAttribute>]
 gam <UserTypeEntity> empty calendartrash <UserCalendarEntity>
@@ -6341,7 +6372,7 @@ gam <UserTypeEntity> show events <UserCalendarEntity> [<EventEntity>] <EventDisp
         [fields <EventFieldNameList>] [showdayofweek]
         [countsonly|formatjson]
 gam <UserTypeEntity> print events <UserCalendarEntity> [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         [eventrowfilter]]
         [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
 
@@ -6526,6 +6557,26 @@ gam <UserItem> print chatspaces asadmin [todrive <ToDriveAttribute>*]
         [fields <ChatSpaceFieldNameList>] [showaccessssettings]
         [formatjson [quotechar <Character>]]
 
+gam <UserTypeEntity> create chatsection
+        displayname <String>
+        [formatjson|returnidonly]
+gam <UserTypeEntity> update chatsection <ChatSection>
+        [displayname <String>]
+        [(sortorder <Integer>)|(position start|end)]
+        [formatjson]
+gam <UserTypeEntity> delete chatsection <ChatSection>
+gam <UserTypeEntity> show chatsections
+        [formatjson]
+gam <UserTypeEntity> print chatsections [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+gam <UserTypeEntity> move chatsectionitem <ChatSectionItem> to <ChatSection>
+gam <UserTypeEntity> show chatsectionitems <ChatSection>
+        [space <ChatSpace>]
+        [formatjson]
+gam <UserTypeEntity> print chatsectionitems  <ChatSection> [todrive <ToDriveAttribute>*]
+        [space <ChatSpace>]
+        [formatjson [quotechar <Character>]]
+
 gam <UserTypeEntity> create chatmember <ChatSpace>
         [type human|bot] [role member|manager|owner]
         (user <UserItem>)* (members <UserTypeEntity>)*
@@ -6836,8 +6887,13 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         <DriveFileCopyAttribute>*
         [skipids <DriveFileEntity>]
         [copysubfiles [<Boolean>]] [filenamematchpattern <REMatchPattern>]
-             [filemimetype [not] <MimeTypeList>]
-        [copysubfilesownedby any|me|others]
+             [filemimetype [not] <MimeTypeList>] [filemimetype category <MimeTypeNameList>]
+        [copysubfilesownedby
+            any|me|others|
+            users <EmailAddressList>|
+            notusers <EmailAddressList>|
+            regex <REMatchPattern>|
+            notregex <REMatchPattern>]
         [copysubfolders [<Boolean>]] [foldernamematchpattern <REMatchPattern>]
         [copysubshortcuts [<Boolean>]] [shortcutnamematchpattern <REMatchPattern>]
         [duplicatefiles overwriteolder|overwriteall|duplicatename|uniquename|skip]
@@ -7453,11 +7509,11 @@ gam <UserTypeEntity> show filecounts
 
 gam <UserTypeEntity> print filesharecounts [todrive <ToDriveAttribute>*]
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 gam <UserTypeEntity> show filesharecounts
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 
 <FileTreeFieldName> ::=
@@ -7525,7 +7581,7 @@ gam <UserTypeEntity> print filelist [todrive <ToDriveAttribute>*]
         [showparentsidsaslist] [showpermissionslast]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])* [delimiter <Character>]
         [stripcrsfromname]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 
 gam <UserTypeEntity> print diskusage <DriveFileEntity> [todrive <ToDriveAttribute>*]
@@ -7984,7 +8040,7 @@ gam <UserTypeEntity> signature|sig
         [html [<Boolean>]] [replyto <EmailAddress>] [default] [treatasalias <Boolean>]
         [name <String>]
         [primary]
-gam <UserTypeEntity> show signature|sig [compact|format|html]
+gam <UserTypeEntity> show signature|sig [compact|format|html|template]
         [primary|default] [verifyonly]
 gam <UserTypeEntity> print signature [compact]
         [primary|default] [verifyonly] [todrive <ToDriveAttribute>*]

src/GamUpdate.txt

@@ -1,3 +1,170 @@
+7.32.04
+
+Support for student groups in Google Classroom no longer requires Developer Preview membership.
+
+Upgraded to OpenSSL 3.6.1.
+
+7.32.03
+
+Added option `template` as an additional formating option for `gam <UserTypeEntity> show signature`
+that displays just the HTML data; this simplifies capturing the data for use as input to GAM.
+```
+$ gam redirect stdout ./SigTemplate.html user user@domain.com show signature template
+$ more SigTemplate.html
+<div dir="ltr"><div dir="ltr"><div dir="ltr">
+<p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)">
+<span style="background-color:rgb(82,208,206)">{RT}Email: {Email}{/RT}</span></p>
+<p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)">
+<span style="background-color:rgb(82,208,206)">{RT}Phone: {Phone}{/RT}</span></p>
+<p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)">
+<span style="background-color:rgb(82,208,206)">{RT}Mobile: {Mobile}{/RT}</span></p>
+</div><br></div>\n</div>
+
+```
+
+7.32.02
+
+Added variable `oauth2_txt_lock_mode` to `gam.cfg`, the default is 644 and valid values are: 644, 664, 666.
+This value is used to set the file permissions on the `oauth2.txt.lock` file. In very special cases where
+daemon processes, e.g. Apache/httpd, are running GAM, the value 666 may have to be used.
+
+7.32.01
+
+Added option `(addcsvdata <FieldName> <String>)*` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand> csv`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID> csv` that adds additional columns of data to the CSV file output.
+* See: https://github.com/GAM-team/GAM/wiki/ChromeOS-Devices#bulk-action-example
+
+7.32.00
+
+Added option `verifyallowexternal` to `gam print cigroup-members|group-members` that causes
+GAM to only display external members in groups with `allowExternalMembers=False'.
+This option can be used to help verify that internal-only groups don't have external members.
+
+Updated option `internaldomains` for the following commands:
+```
+gam info|print groups
+gam print|show group-members
+gam info|print cigroups
+gam print|show cigroup-members
+gam <UserTypeEntity> print|show filesharecounts
+```
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+Added option `csv` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand>`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID>` so that command details are displayed in CSV format.
+This can be used to log commands issued to devices and then monitor the results.
+
+Added option `filemimetype category <MimeTypeNameList>` to `gam <UserTypeEntity> copy drivefile` to support
+copying of files based on their MimeType category.
+
+Added option `attendeeslist` to `gam calendars <CalendarEntity> print events` and `gam <UserTypeEntity> print events`
+that causes GAM to display the attendee email addresses in a single column `attendeesList`; no attendee details
+are displayed. The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
+Fixed bug in `gam sendemail ... replyto <EmailAddress>` that caused a message delivery error if
+`<EmailAddress>` did not include a domain name.
+
+Added support for users's chat sections.
+* See: https://github.com/GAM-team/GAM/wiki/Users-Chat#manage-chat-users-sections
+* This is in Deveoper Preview; you must have a `developer_preview_api_key` in `gam.cfg` to use these commands.
+
+7.31.06
+
+Added option `batchsize <Integer>` to `gam calendar <CalendarEntity> delete|purge events` and
+`gam <UserTypeEntity> delete|purge events <UserCalendarEntity>` that causes GAM to delete events
+with batch API calls rather than with individual API calls.
+
+7.31.05
+
+Added option `variables <RESearchPattern>` to `gam select section <SectionName> verify` and `gam config verify`
+that causes GAM to only display variables with names selected by `<RESearchPattern>`.
+```
+gam select School verify variables "^(customer|domain)"
+Section: School
+  customer_id = C03abc123
+  domain = school.edu
+
+gam config verify variables  'dir'
+Section: DEFAULT
+  cache_dir = ~/GamConfig/gamcache ; /Users/gamteam/GamConfig/gamcache
+  config_dir = ~/GamConfig ; /Users/gamteam/GamConfig
+  drive_dir = ~/GamWork ; /Users/gamteam/GamWork
+  gmail_cse_incert_dir = ~/GmailCSE/Certs ; /Users/gamteam/GmailCSE/Certs
+  gmail_cse_inkey_dir = ~/GmailCSE/Keys ; /Users/gamteam/GmailCSE/Keys
+  input_dir = .
+```
+
+7.31.04
+
+Fixed bug in `gam report admin|chrome` that caused to events to not be displayed.
+
+Updated `gam <UserTypeEntity> print|show messages|threads ... query <QueryGmail>` to display the query.
+
+7.31.03
+
+Due to the following Calendar API update, the `gam <UserTypeEntity> transfer calendars` command has been removed.
+* See: https://developers.google.com/workspace/calendar/release-notes#October_27_2025
+Data ownership can be transferred in the Google Calendar UI.
+
+7.31.02
+
+Added the following options to `gam <UserTypeEntity> copy drivefile`
+to limit copying to those files owned by selected users.
+* `copysubfilesownedby users <EmailAddressList>` - Only files owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby notusers <EmailAddressList>` - Only files not owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby regex <REMatchPattern>` - Only files owned by users whose email addresses match `<REMatchPattern>` are copied.
+* `copysubfilesownedby notregex <REMatchPattern>` - Only files owned by users whose email addresses do not match `<REMatchPattern>` are copied.
+
+7.31.01
+
+Code cleanup for `addcsvdata <FieldName> <String>`.
+
+7.31.00
+
+Fixed bug in `gam report chrome (user <UserItem>)|(select <UserTypeEntity>)` where no activities were returned.
+`report chrome` does not use the parameter `userKey=<EmailAddress>` as do other applications but requires
+parameter `filter DEVICE_USER==<EmailAddress>`.
+
+Updated `gam report admin (user <UserItem>)|(select <UserTypeEntity>)` to use parameter `filter USER_EMAIL==<EmailAddress>`
+to display activiities affecting the user `<EmailAddress>`. Use option `userisactor` to use the parameter `userKey=<EmailAddress>`
+that displays activities where user `<EmailAddress>` executed the command that generated the activity.
+
+Fixed bug in `gam print cros|filelist|users ... (addcsvdata <FieldName> <String>)+ formatjson` where the `addcsvdata` columns
+were not displayed but the additional field values were included in the JSON data. Now, the `addcsvdata` columns
+are displayed but the additional field values are only included in the JSON data when option `includdecsvdatainjson` is specified.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroups|groups`
+that adds additional columns of data to the CSV file output.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroupmembere|group-members`
+that adds additional columns of data to the CSV file output.
+
+7.30.05
+
+Added option `gmaileventtypes <NumberRangeList>` to `gam report gmail` that can be used to limit the event types displayed.
+```
+<NumberRange> ::= <Number>|(<Number>/<Number>)
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
+
+gam report gmail user user@domain.com gmaileventtypes 1,10/11
+```
+* See: https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gmail
+
+Updated sorting of column headers in `gam report <ActivityApplicationName>`.
+
+7.30.04
+
+Updated `gam report gmail` to avoid the following error when incomplete start/end time information is provided.
+```
+ERROR: Invalid request: Start time and end time should both be provided, and the scan duration should not be greater than 30 days.
+```
+* No time information provided - GAM sets `range -30d today`
+* Only `start <Time>`  provided - GAM sets `end <Time>+30d`
+* Only `end <Time>` provided - GAM sets `start <Time>-30d`
+
 7.30.03
 
 Updated `gam report <ActivityApplicationName>` to reflect the changes described here:

src/gam/gamlib/glapi.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -32,6 +32,7 @@ CHAT_EVENTS = 'chatevents'
 CHAT_MEMBERSHIPS = 'chatmemberships'
 CHAT_MEMBERSHIPS_ADMIN = 'chatmembershipsadmin'
 CHAT_MESSAGES = 'chatmessages'
+CHAT_SECTIONS = 'chatsections'
 CHAT_SPACES = 'chatspaces'
 CHAT_SPACES_ADMIN = 'chatspacesadmin'
 CHAT_SPACES_DELETE = 'chatspacesdelete'
@@ -229,6 +230,7 @@ _INFO = {
   CHAT_MEMBERSHIPS: {'name': 'Chat API - Memberships', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_MEMBERSHIPS_ADMIN: {'name': 'Chat API - Memberships Admin', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_MESSAGES: {'name': 'Chat API - Messages', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
+  CHAT_SECTIONS: {'name': 'Chat API - User Sections', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_SPACES: {'name': 'Chat API - Spaces', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_SPACES_ADMIN: {'name': 'Chat API - Spaces Admin', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
   CHAT_SPACES_DELETE: {'name': 'Chat API - Spaces Delete', 'version': 'v1', 'v2discovery': True, 'mappedAPI': CHAT},
@@ -594,6 +596,11 @@ _SVCACCT_SCOPES = [
    'api': CHAT_MESSAGES,
    'subscopes': READONLY,
    'scope': 'https://www.googleapis.com/auth/chat.messages'},
+  {'name': 'Chat API - User Sections',
+   'api': CHAT_SECTIONS,
+   'offByDefault': True,
+   'subscopes': READONLY,
+   'scope': 'https://www.googleapis.com/auth/chat.users.sections'},
   {'name': 'Chat API - Spaces',
    'api': CHAT_SPACES,
    'subscopes': READONLY,

src/gam/gamlib/glcfg.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -218,6 +218,8 @@ NUM_TBATCH_THREADS = 'num_tbatch_threads'
 NUM_THREADS = 'num_threads'
 # Path to oauth2.txt
 OAUTH2_TXT = 'oauth2_txt'
+# File permissions for oauth2.txt.lock
+OAUTH2_TXT_LOCK_MODE = 'oauth2_txt_lock_mode'
 # Path to oauth2service.json
 OAUTH2SERVICE_JSON = 'oauth2service_json'
 # Output date format, empty defalts to ISOFormat
@@ -416,6 +418,7 @@ Defaults = {
   NUM_TBATCH_THREADS: '2',
   NUM_THREADS: '5',
   OAUTH2_TXT: FN_OAUTH2_TXT,
+  OAUTH2_TXT_LOCK_MODE: '644',
   OAUTH2SERVICE_JSON: FN_OAUTH2SERVICE_JSON,
   OUTPUT_DATEFORMAT: '',
   OUTPUT_TIMEFORMAT: '',
@@ -587,6 +590,7 @@ VAR_INFO = {
   NUM_TBATCH_THREADS: {VAR_TYPE: TYPE_INTEGER, VAR_LIMITS: (1, 1000)},
   NUM_THREADS: {VAR_TYPE: TYPE_INTEGER, VAR_ENVVAR: 'GAM_THREADS', VAR_LIMITS: (1, 1000)},
   OAUTH2_TXT: {VAR_TYPE: TYPE_FILE, VAR_ENVVAR: 'OAUTHFILE', VAR_ACCESS: os.R_OK | os.W_OK},
+  OAUTH2_TXT_LOCK_MODE: {VAR_TYPE: TYPE_CHOICE, VAR_CHOICES: {'644': 0o644, '664': 0o664, '666': 0o666}},
   OAUTH2SERVICE_JSON: {VAR_TYPE: TYPE_FILE, VAR_ENVVAR: 'OAUTHSERVICEFILE', VAR_ACCESS: os.R_OK | os.W_OK},
   OUTPUT_DATEFORMAT: {VAR_TYPE: TYPE_STRING, VAR_LIMITS: (0, None)},
   OUTPUT_TIMEFORMAT: {VAR_TYPE: TYPE_STRING, VAR_LIMITS: (0, None)},

src/gam/gamlib/glclargs.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -751,6 +751,10 @@ class GamCLArgs():
   ARG_CHATMEMBERS = 'chatmembers'
   ARG_CHATMESSAGE = 'chatmessage'
   ARG_CHATMESSAGES = 'chatmessages'
+  ARG_CHATSECTION = 'chatsection'
+  ARG_CHATSECTIONS = 'chatsections'
+  ARG_CHATSECTIONITEM = 'chatsectionitem'
+  ARG_CHATSECTIONITEMS = 'chatsectionitems'
   ARG_CHATSPACE = 'chatspace'
   ARG_CHATSPACES = 'chatspaces'
   ARG_CHATSPACEDM = 'chatspacedm'
@@ -924,6 +928,8 @@ class GamCLArgs():
   ARG_GUARDIANINVITE = 'guardianinvite'
   ARG_GUARDIANINVITATION = 'guardianinvitation'
   ARG_GUARDIANINVITATIONS = 'guardianinvitations'
+  ARG_GUESTUSER = 'guestuser'
+  ARG_GUESTUSERS = 'guestusers'
   ARG_HOLD = 'hold'
   ARG_HOLDS = 'holds'
   ARG_IMAP = 'imap'
@@ -1157,6 +1163,7 @@ class GamCLArgs():
   OB_CHAT_MEMBER = 'ChatMember'
   OB_CHAT_MESSAGE = 'ChatMessage'
   OB_CHAT_MESSAGE_ID = 'ChatMessageID'
+  OB_CHAT_SECTION = 'ChatSection'
   OB_CHAT_SPACE = 'ChatSpace'
   OB_CHAT_SPACE_LIST = 'ChatSpaceList'
   OB_CHAT_THREAD = 'ChatThread'
@@ -1286,6 +1293,7 @@ class GamCLArgs():
   OB_MOBILE_ENTITY = 'MobileEntity'
   OB_NETWORK_ID = 'networkID'
   OB_NAME = 'Name'
+  OB_NUMBER_RANGE_LIST = 'NumberRangeList'
   OB_ORGANIZER_TYPE_LIST = 'OrganizerTypeList'
   OB_ORGUNIT_ENTITY = 'OrgUnitEntity'
   OB_ORGUNIT_ITEM = 'OrgUnitItem'

src/gam/gamlib/glentity.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -97,6 +97,8 @@ class GamEntity():
   CHAT_MESSAGE = 'chms'
   CHAT_MESSAGE_ID = 'chmi'
   CHAT_OWNER_USER = 'chou'
+  CHAT_SECTION = 'chse'
+  CHAT_SECTION_ITEM = 'chsi'
   CHAT_SPACE = 'chsp'
   CHAT_THREAD = 'chth'
   CHILD_ORGANIZATIONAL_UNIT = 'corg'
@@ -251,6 +253,7 @@ class GamEntity():
   GUARDIAN = 'guar'
   GUARDIAN_INVITATION = 'gari'
   GUARDIAN_AND_INVITATION = 'gani'
+  GUEST_USER = 'gstu'
   IAM_POLICY = 'iamp'
   IMAP_ENABLED = 'imap'
   INBOUND_SSO_ASSIGNMENT = 'insa'
@@ -356,7 +359,7 @@ class GamEntity():
   SNIPPETS_ENABLED = 'snip'
   SSO_KEY = 'ssok'
   SSO_SETTINGS = 'ssos'
-  SOURCE_USER = 'src'
+  SOURCE_USER = 'srcu'
   SPREADSHEET = 'sprd'
   SPREADSHEET_RANGE = 'ssrn'
   START_TIME = 'strt'
@@ -465,6 +468,8 @@ class GamEntity():
     CHAT_MEMBER_GROUP: ['Chat Group Members', 'Chat Group Member'],
     CHAT_MEMBER_USER: ['Chat User Members', 'Chat User Member'],
     CHAT_OWNER_USER: ['Chat User Owners', 'Chat User Owner'],
+    CHAT_SECTION: ['Chat User Sections', 'Chat User Section'],
+    CHAT_SECTION_ITEM: ['Chat User Section Items', 'Chat User Section Item'],
     CHAT_SPACE: ['Chat Spaces', 'Chat Space'],
     CHAT_THREAD: ['Chat Threads', 'Chat Thread'],
     CHILD_ORGANIZATIONAL_UNIT: ['Child Organizational Units', 'Child Organizational Unit'],
@@ -616,6 +621,7 @@ class GamEntity():
     GROUP_MEMBERSHIP_TREE: ['Group Membership Trees', 'Group Membership Tree'],
     GROUP_SETTINGS: ['Group Settings', 'Group Settings'],
     GROUP_TREE: ['Group Trees', 'Group Tree'],
+    GUEST_USER: ['Guest Users', 'Guest User'],
     GUARDIAN: ['Guardians', 'Guardian'],
     GUARDIAN_INVITATION: ['Guardian Invitations', 'Guardian Invitation'],
     GUARDIAN_AND_INVITATION: ['Guardians and Invitations', 'Guardian and Invitation'],

src/gam/gamlib/glgapi.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -42,6 +42,7 @@ CANNOT_DELETE_PERMISSION = 'cannotDeletePermission'
 CANNOT_DELETE_PRIMARY_CALENDAR = 'cannotDeletePrimaryCalendar'
 CANNOT_DELETE_PRIMARY_SENDAS = 'cannotDeletePrimarySendAs'
 CANNOT_DELETE_RESOURCE_WITH_CHILDREN = 'cannotDeleteResourceWithChildren'
+CANNOT_MODIFY_ACL_OF_CALENDAR_OWNER = 'cannotModifyAclOfCalendarOwner'
 CANNOT_MODIFY_INHERITED_PERMISSION = 'cannotModifyInheritedPermission'
 CANNOT_MODIFY_INHERITED_TEAMDRIVE_PERMISSION = 'cannotModifyInheritedTeamDrivePermission'
 CANNOT_MODIFY_RESTRICTED_LABEL = 'cannotModifyRestrictedLabel'
@@ -55,6 +56,7 @@ CANNOT_SHARE_GROUPS_WITHLINK = 'cannotShareGroupsWithLink'
 CANNOT_SHARE_USERS_WITHLINK = 'cannotShareUsersWithLink'
 CANNOT_SHARE_TEAMDRIVE_TOPFOLDER_WITH_ANYONEORDOMAINS = 'cannotShareTeamDriveTopFolderWithAnyoneOrDomains'
 CANNOT_SHARE_TEAMDRIVE_WITH_NONGOOGLE_ACCOUNTS = 'cannotShareTeamDriveWithNonGoogleAccounts'
+CANNOT_UNSUBSCRIBE_FROM_OWNED_CALENDAR = 'cannotUnsubscribeFromOwnedCalendar'
 CANNOT_UPDATE_PERMISSION = 'cannotUpdatePermission'
 CONDITION_NOT_MET = 'conditionNotMet'
 CONFLICT = 'conflict'
@@ -179,6 +181,7 @@ TEAMDRIVES_SHARING_RESTRICTION_NOT_ALLOWED = 'teamDrivesSharingRestrictionNotAll
 TEAMDRIVES_SHORTCUT_FILE_NOT_SUPPORTED = 'teamDrivesShortcutFileNotSupported'
 TIME_RANGE_EMPTY = 'timeRangeEmpty'
 TRANSIENT_ERROR = 'transientError'
+UNIMPLEMENTED_ERROR = 'unimplementedError'
 UNKNOWN_ERROR = 'unknownError'
 UNSUPPORTED_LANGUAGE_CODE = 'unsupportedLanguageCode'
 UNSUPPORTED_SUPERVISED_ACCOUNT = 'unsupportedSupervisedAccount'
@@ -195,7 +198,7 @@ ACTIVITY_THROW_REASONS = [SERVICE_NOT_AVAILABLE, BAD_REQUEST]
 ALERT_THROW_REASONS = [SERVICE_NOT_AVAILABLE, AUTH_ERROR, PERMISSION_DENIED]
 CALENDAR_THROW_REASONS = [SERVICE_NOT_AVAILABLE, AUTH_ERROR, NOT_A_CALENDAR_USER]
 CIGROUP_CREATE_THROW_REASONS = [SERVICE_NOT_AVAILABLE, ALREADY_EXISTS, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_ARGUMENT, PERMISSION_DENIED, FAILED_PRECONDITION]
-CIGROUP_GET_THROW_REASONS = [SERVICE_NOT_AVAILABLE, NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, SYSTEM_ERROR, PERMISSION_DENIED]
+CIGROUP_GET_THROW_REASONS = [SERVICE_NOT_AVAILABLE, NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, INVALID_ARGUMENT, SYSTEM_ERROR, PERMISSION_DENIED]
 CIGROUP_LIST_THROW_REASONS = [SERVICE_NOT_AVAILABLE, RESOURCE_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, INVALID_ARGUMENT, SYSTEM_ERROR, PERMISSION_DENIED]
 CIGROUP_LIST_USERKEY_THROW_REASONS = CIGROUP_LIST_THROW_REASONS+[INVALID_ARGUMENT]
 CIGROUP_UPDATE_THROW_REASONS = [SERVICE_NOT_AVAILABLE, NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS,
@@ -405,6 +408,8 @@ class cannotDeletePrimarySendAs(Exception):
   pass
 class cannotDeleteResourceWithChildren(Exception):
   pass
+class cannotModifyAclOfCalendarOwner(Exception):
+  pass
 class cannotModifyInheritedPermission(Exception):
   pass
 class cannotModifyInheritedTeamDrivePermission(Exception):
@@ -431,6 +436,8 @@ class cannotShareTeamDriveTopFolderWithAnyoneOrDomains(Exception):
   pass
 class cannotShareTeamDriveWithNonGoogleAccounts(Exception):
   pass
+class cannotUnsubscribeFromOwnedCalendar(Exception):
+  pass
 class cannotUpdatePermission(Exception):
   pass
 class conditionNotMet(Exception):
@@ -671,6 +678,8 @@ class timeRangeEmpty(Exception):
   pass
 class transientError(Exception):
   pass
+class unimplementedError(Exception):
+  pass
 class unknownError(Exception):
   pass
 class unsupportedLanguageCode(Exception):
@@ -710,6 +719,7 @@ REASON_EXCEPTION_MAP = {
   CANNOT_DELETE_PRIMARY_CALENDAR: cannotDeletePrimaryCalendar,
   CANNOT_DELETE_PRIMARY_SENDAS: cannotDeletePrimarySendAs,
   CANNOT_DELETE_RESOURCE_WITH_CHILDREN: cannotDeleteResourceWithChildren,
+  CANNOT_MODIFY_ACL_OF_CALENDAR_OWNER: cannotModifyAclOfCalendarOwner,
   CANNOT_MODIFY_INHERITED_PERMISSION: cannotModifyInheritedPermission,
   CANNOT_MODIFY_INHERITED_TEAMDRIVE_PERMISSION: cannotModifyInheritedTeamDrivePermission,
   CANNOT_MODIFY_RESTRICTED_LABEL: cannotModifyRestrictedLabel,
@@ -723,6 +733,7 @@ REASON_EXCEPTION_MAP = {
   CANNOT_SHARE_USERS_WITHLINK: cannotShareUsersWithLink,
   CANNOT_SHARE_TEAMDRIVE_TOPFOLDER_WITH_ANYONEORDOMAINS: cannotShareTeamDriveTopFolderWithAnyoneOrDomains,
   CANNOT_SHARE_TEAMDRIVE_WITH_NONGOOGLE_ACCOUNTS: cannotShareTeamDriveWithNonGoogleAccounts,
+  CANNOT_UNSUBSCRIBE_FROM_OWNED_CALENDAR: cannotUnsubscribeFromOwnedCalendar,
   CANNOT_UPDATE_PERMISSION: cannotUpdatePermission,
   CONDITION_NOT_MET: conditionNotMet,
   CONFLICT: conflict,
@@ -843,6 +854,7 @@ REASON_EXCEPTION_MAP = {
   TEAMDRIVES_SHORTCUT_FILE_NOT_SUPPORTED: teamDrivesShortcutFileNotSupported,
   TIME_RANGE_EMPTY: timeRangeEmpty,
   TRANSIENT_ERROR: transientError,
+  UNIMPLEMENTED_ERROR: unimplementedError,
   UNKNOWN_ERROR: unknownError,
   UNSUPPORTED_LANGUAGE_CODE: unsupportedLanguageCode,
   UNSUPPORTED_SUPERVISED_ACCOUNT: unsupportedSupervisedAccount,

src/gam/gamlib/glglobals.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #

wiki/Authorization.md

@@ -30,8 +30,8 @@
   - [Update an existing Service Account key](#update-an-existing-service-account-key)
   - [Replace all existing Service Account keys](#replace-all-existing-service-account-keys)
   - [Delete Service Account keys](#delete-service-account-keys)
-  - [Upload a Service Account key to a service account with no keys](#upload-a-service-account-key-to-a-service-account-with-no-keys)
   - [Display Service Account keys](#display-service-account-keys)
+  - [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
 - [Manage Service Account access](#manage-service-account-access)
   - [Full Service Account access](#full-service-account-access)
   - [Selective Service Account access](#selective-service-account-access)
@@ -781,6 +781,14 @@ Here are some sample values:
 Create a new Service Account private key; all existing private keys remain valid.
 The `oauth2service.json` file is updated with the new private key.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 Keep a good record of where each Service Account key is used as the keys themselves do not record this information.
 
 The two forms of the command are equivalent; the second form is used by Legacy GAM.
@@ -809,6 +817,14 @@ The `oauth2service.json` file is updated with the new private key. If you had pr
 this `oauth2service.json` file to other users, you must redistribute the updated file as the private key
 in the distributed copies has been revoked.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 The two forms of the command are equivalent; the second form is used by Legacy GAM.
 ```
 gam update sakey
@@ -828,6 +844,14 @@ in the distributed copies has been revoked.
 
 This command can be used if your Service Account keys have been compromised; all existing private keys are revoked.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 The two forms of the command are equivalent; the second form is used by Legacy GAM.
 ```
 gam replace sakeys
@@ -844,25 +868,20 @@ You can delete Service Accounts keys thus revoking access for that key. Generall
 delete a service account key for a distributed copy of an `oauth2service.json` file to disable
 that user's service account access.
 
+This command requires that the current Service Account private key is valid, if you get the following error:
+```
+ERROR: 401: authError - Request had invalid authentication credentials.
+Expected OAuth 2 access token, login cookie or other valid authentication credential.
+See https://developers.google.com/identity/sign-in/web/devconsole-project.
+```
+see: [Upload a Service Account key to a service account without a valid private key](#upload-a-service-account-key-to-a-service-account-without-a-valid-private-key)
+
 You can disable your current Service Account key if you specify the `doit` argument. This is your
 acknowledgement that you will have to manually create a new Service Account key in the Developer's Console
 or upload a new key with the `gam upload sakey` command.
 ```
 gam delete sakeys <ServiceAccountKeyList>+ [doit]
 ```
-## Upload a Service Account key to a service account with no keys
-There are two cases where you will use this command:
-* Your workspace is configured to disable service account private key uploads and you are creating a project.
-* All of your service account keys have been deleted, either manually or with the `gam delete sakeys` command.
-
-The `oauth2service.json` file is updated with the new private key. If you had previously distributed
-any `oauth2service.json` file to other users, you must redistribute the updated file with the new key.
-```
-gam upload sakey [admin <EmailAddress>]
-        (algorithm KEY_ALG_RSA_1024|KEY_ALG_RSA_2048)|
-        (localkeysize 1024|2048|4096 [validityhours <Number>])|
-        (yubikey yubikey_pin yubikey_slot AUTHENTICATION|SIGNATURE yubikey_serialnumber <Number>)
-```
 ## Display Service Account keys
 There are system keys and user keys; user keys are what Gam uses; GCP uses system keys.
 
@@ -876,6 +895,19 @@ gam show sakeys [all|system|user]
 
 The private key currently being used in `oauth2service.json` will be marked as `usedToAuthenticateThisRequest: True`.
 
+## Upload a Service Account key to a service account without a valid private key
+There are two cases where you will use this command:
+* Your workspace is configured to disable service account private key uploads and you are creating a project.
+* All of your service account keys have been deleted, either manually or with the `gam delete sakeys` command.
+
+The `oauth2service.json` file is updated with the new private key. If you had previously distributed
+any `oauth2service.json` file to other users, you must redistribute the updated file with the new key.
+```
+gam upload sakey [admin <EmailAddress>]
+        (algorithm KEY_ALG_RSA_1024|KEY_ALG_RSA_2048)|
+        (localkeysize 1024|2048|4096 [validityhours <Number>])|
+        (yubikey yubikey_pin yubikey_slot AUTHENTICATION|SIGNATURE yubikey_serialnumber <Number>)
+```
 ## Manage Service Account access
 
 ## Full Service Account access

wiki/Basic-Items.md

@@ -283,6 +283,8 @@
 <ChatEmoji> ::= emojiname <ChatEmojiName> | customemojis/<String>
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMessage> ::= spaces/<String>/messages/<String>
+<ChatSection> ::= users/<String>/sections/<String> | sections/<String> | section <String>
+<ChatSectionItem> ::= users/<String>/sections/<String>/items/<String> | sections/<String>/items/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChromeProfilePermanentID> ::= <String>
@@ -426,6 +428,7 @@
         (gdoc|ghtml <UserGoogleDoc>)|
         (gcsdoc|gcshtml <StorageBucketObjectName>)
 <NumberOfSeats> ::= <Number>
+<NumberRange> ::= <Number>|(<Number>/<Number>)
 <OrgUnitID> ::= id:<String>
 <OrgUnitPath> ::= /|(/<String>)+
 <OrgUnitItem> ::= <OrgUnitID>|<OrgUnitPath>
@@ -566,11 +569,11 @@
         (tdreturnidonly [<Boolean>])|
         (tdshare <EmailAddress> commenter|reader|writer)*|
         (tdsheet (id:<Number>)|<String>)|
-        (tdsheettimestamp [<Boolean>] [tdsheettimeformat <String>])
+        (tdsheettimestamp [<Boolean>] [tdsheettimeformat <DateTimeFormat>])
         (tdsheettitle <String>)|
         (tdsubject <String>)|
         ([tdsheetdaysoffset <Number>] [tdsheethoursoffset <Number>])|
-        (tdtimestamp [<Boolean>] [tdtimeformat <String>]
+        (tdtimestamp [<Boolean>] [tdtimeformat <DateTimeFormat>]
             [tddaysoffset <Number>] [tdhoursoffset <Number>])|
         (tdtimezone <TimeZone>)|
         (tdtitle <String>)|

wiki/Bulk-Processing.md

@@ -38,6 +38,7 @@ Batch files can contain the following types of lines:
 * Blank lines - Ignored
 * \# Comment line - Ignored
 * gam \<GAMArgumentList\> - Execute a GAM command 
+  * File path arguments in \<GAMArgumentList\> should be enclosed in \"
 * commit-batch
   * GAM waits for all running GAM commands to complete
   * GAM continues

wiki/Calendars-Events.md

@@ -516,11 +516,16 @@ Use `jsonattendees file ./attendees.json` in `create/update event`.
 
 ## Delete selected calendar events
 ```
-gam calendar <CalendarEntity> delete events [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam calendar <CalendarEntity> purge events [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam calendar <CalendarEntity> delete events [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam calendar <CalendarEntity> purge events [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 ```
 If `<EventEntity>` is not specified, all events in `<CalendarEntity>` are selected. This is not typically used.
 
+By default, each event is deleted in a separate API call, use `batchsize` with an integer between 1 and 1000
+to delete the events in batches.
+
 No events are deleted unless you specify the `doit` option; omit `doit` to verify that you properly selected the events to delete.
 
 When events are deleted from a calendar, they are moved to the calendar's trash and are only permanently deleted (purged) after 30 days.
@@ -590,7 +595,7 @@ By default, Gam displays event details, use `countsonly` to display only the num
 
 ```
 gam calendar <CalendarEntity> print events [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         (addcsvdata <FieldName> <String>)*
         [eventrowfilter]
         [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
@@ -604,6 +609,10 @@ option `singleevents` to display all instances of a recurring event.
 
 `showdayofweek` displays columns `start.dayOfWeek` and `end.dayOfWeek` when event start and end times are displayed.
 
+By default, each attendee is displayed in a separate column; `attendeeslist` causes GAM to display
+the attendee email addresses in a single column `attendeesList`; no attendee details are displayed.
+The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
 Add additional columns of data from the command line to the output after the calendarId.
 * `addcsvdata <FieldName> <String>`
 

wiki/ChromeOS-Devices.md

@@ -14,6 +14,7 @@
 - [Action ChromeOS devices](#action-chromeos-devices)
 - [Send remote commands to ChromeOS devices](#send-remote-commands-to-chromeos-devices)
   - [Action Examples](#action-examples)
+  - [Bulk Action Example](#bulk-action-example)
 - [ChromeOS device lists](#chromeos-device-lists)
 - [Display information about ChromeOS devices](#display-information-about-chromeos-devices)
 - [Print ChromeOS devices](#print-chromeos-devices)
@@ -445,12 +446,19 @@ is configurable from 0 to some large number. If the status reaches `EXPIRED`, `C
         wipe_users|
         take_a_screenshot
 
-gam <CrOSTypeEntity> issuecommand command <CrOSCommand> [times_to_check_status <Integer>] [doit]
+gam <CrOSTypeEntity> issuecommand command <CrOSCommand>
+        [times_to_check_status <Integer>] [csv] [doit]
 ```
+By default, when a Chrome command is issued, GAM outputs details of the command status as indented keywords and values.
+* `csv` - Output the details in CSV format.
+
 If the final status is not reached before GAM exits, you can issue the following commands to continue checking the status.
 ```
-gam <CrOSTypeEntity> getcommand commandid <CommandID> [times_to_check_status <Integer>]
+gam <CrOSTypeEntity> getcommand commandid <CommandID>
+        [times_to_check_status <Integer>] [csv]
 ```
+By default, when a Chrome command status is read, GAM outputs details of the command status as indented keywords and values.
+* `csv` - Output the details in CSV format.
 
 ### Action Examples
 Remove user profile data from the device; the device will remain enrolled and connected.
@@ -476,6 +484,40 @@ Use `wipe_users` if that's going to create too much work for you.
 ```
 gam cros_ou /StudentCarts issuecommand command remote_powerwash times_to_check_status 0 doit
 ```
+
+### Bulk Action example
+You want to issue commands to many ChromeOS devices and monitor the results.
+
+Assume a Google Sheet with two tabs: Commands and Results
+The Commands tab has at least two columns: serialNumber and command
+```
+serialNumber,command
+abc123def123,reboot
+abc123def456,remote_powerwash
+abc123def789,wipe_users
+```
+Here is the URL for the Commands tab
+```
+https://docs.google.com/spreadsheets/d/12349lNWvZwzJhwxyz/edit?gid=1588227640#gid=1588227640
+<SheetFileID> = 12349lNWvZwzJhwxyz
+<CommandTabID> = 1588227640
+Here is the URL for the Commands tab
+https://docs.google.com/spreadsheets/d/12349lNWvZwzJhwxyz/edit?gid=2102420937#gid=2102420937
+<SheetFileID> = 12349lNWvZwzJhwxyz
+<ResultsTabID> = 2102420937
+```
+Replace `user@domain.com` with the email address of the Google Sheet owner.
+
+Issue the commands from the Commands tab and write the results to the Results tab; copy the `serialNumber` to the Results tab.
+```
+gam config num_threads 20 redirect csv - multiprocess sortheaders serialNumber todrive tduser user@domain.com tdfileID <SheetFileID> tdsheet id:<ResultsTabID> tdupdatesheet tdretaintitle redirect stderr - multiprocess csv gsheet user@domain.com <SheetFileID> id:<CommandsTabID> gam cros_sn "~serialNumber" issuecommand command "~command" doit csv addcsvdata serialNumber "~serialNumber"
+```
+Monitor the results by reading and updating the results from/to the Results tab; copy the `serialNumber` to the Results tab.
+```
+gam config num_threads 20 redirect csv - multiprocess sortheaders serialNumber todrive tduser user@domain.com tdfileID <SheetFileID> tdsheet id:<ResultsTabID> tdupdatesheet tdretaintitle redirect stderr - multiprocess csv gsheet user@domain.com <SheetFileID> id:<ResultsTabID> gam cros "~deviceId" getcommand commandid "~commandId" csv addcsvdata serialNumber "~serialNumber"
+```
+You can use additional `addcsvdata` options to copy device identifying information from the source to the destination.
+
 ## ChromeOS device lists
 ChromeOS devices have lists of data: `<CrOSListFieldName>`, `<CrOSActivityListFieldName>`, `<CrOSTelemetryListFieldName>`.
 All lists except `recentusers` are in ascending order (oldest to newest). As these lists can contain many entries,
@@ -544,7 +586,7 @@ gam print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 ```
@@ -591,9 +633,11 @@ Add additional columns of data from the command line to the output
 * `addcsvdata <FieldName> <String>`
 
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
-
 - `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
@@ -612,7 +656,7 @@ gam <CrOSTypeEntity> print cros [todrive <ToDriveAttribute>*]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 
@@ -623,6 +667,7 @@ gam print cros [todrive <ToDriveAttribute>*] select <CrOSTypeEntity>
         [start <Date>] [end <Date>] [listlimit <Number>]
         [reverselists <CrOSListFieldNameList>]
         [timerangeorder ascending|descending] [showdvrsfp]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [sortheaders]
         [formatjson [quotechar <Character>]]
 ```
@@ -645,9 +690,11 @@ Add additional columns of data from the command line to the output
 * `addcsvdata <FieldName> <String>`
 
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
-
 - `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Cloud-Identity-Devices.md

@@ -40,6 +40,18 @@ Use `gam user user@domain.com update serviceaccount` and make sure that the foll
 * [Filters](https://support.google.com/a/answer/7549103)
 * [Device Search Fields](https://developers.google.com/admin-sdk/directory/v1/search-operators)
 
+Use this table to filter/query for specific device types:
+| Device Type | Filter/Query |
+|-------------|--------------|
+| ANDROID | type:android |
+| CHROME_OS | type:chromeos |
+| GOOGLE_SYNC | type:googlesync |
+| IOS | type:ios |
+| LINUX | type:linux |
+| MAC_OS | type:mac |
+| WINDOWS | type:windows |
+
+
 ## Definitions
 ```
 <AssetTag> ::= <String>
@@ -370,7 +382,6 @@ Windows Command Prompt
 for /f "delims=" %a in ('gam print deviceusers queries "'model:Mac'" showitemcountonly') do set count=%a
 ```
 
-
 ## Display device user client state
 ```
 gam info deviceuserstate <DeviceUserEntity> [clientid <String>] 
@@ -379,11 +390,11 @@ gam info deviceuserstate <DeviceUserEntity> [clientid <String>]
 ## Update device user client state
 The API that supports this command is in beta mode. In particular, setting `assettags` and `customvalues`
 works if you set the values once; each additional time you set values they are added to the existing values
-and they is no way at the moment to clear values.
+and the `clear` option does not work to clear values.
 ```
 gam update deviceuserstate <DeviceUserEntity> [clientid <String>] 
         [customid <String>] [assettags clear|<AssetTagList>]
         [compliantstate|compliancestate compliant|noncompliant] [managedstate clear|managed|unmanaged]
         [healthscore very_poor|poor|neutral|good|very_good] [scorereason clear|<String>]
-        (customvalue (bool|boolean <Boolean>)|(number <Integer>)|(string <String>))*
+        (customvalue clear|(bool|boolean <String> <Boolean>)|(number <String> <Integer>)|(string <String> <String>))*
 ```

wiki/Cloud-Identity-Groups-Membership.md

@@ -13,7 +13,7 @@
 - [Display user group member options](#display-user-group-member-options)
 - [Display group membership in CSV format](#display-group-membership-in-csv-format)
 - [Display group membership in hierarchical format](#display-group-membership-in-hierarchical-format)
-
+- [Display external users in groups with allowExternalMembers False](#display-external-users-in-groups-with-allowexternalmembers-false)
 ## API documentation
 * [Cloud Identity Groups Overview](https://cloud.google.com/identity/docs/groups)
 * [Cloud Identity Groups API - Groups](https://cloud.google.com/identity/docs/reference/rest/v1/groups)
@@ -349,11 +349,15 @@ gam print cigroup-members [todrive <ToDriveAttribute>*]
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
+        [verifyallowexternal [<Boolean>]]
         [types <CIGroupMemberTypeList>]
         <CIGroupMembersFieldName>* [fields <CIGroupMembersFieldNameList>]
         [minimal|basic|full]
         [(recursive [noduplicates]) | |includederivedmembership] [nogroupeemail]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
+        (addcsvdata <FieldName> <String>)*
+        [formatjson [quotechar <Character>]]
 ```
 By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
 * `cimember <UserItem>` - Limit display to groups that contain `<UserItem>` as a member
@@ -378,6 +382,24 @@ By default, all members, managers and owners in the group are displayed; these o
 By default, all types of members (cbcmbrowser, chromeosdevice, customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group and adds the column `category` that shows whether the member
+is `external` or `internal`.
+
+The option `verifyallowexternal` causes GAM to only display `external` users in groups with `allowExternalMembers=False'.
+
 By default, members that are groups are displayed as a single entry of type GROUP; this option recursively expands group members to display their user members.
 * `recursive` - Recursively expand group members
 
@@ -414,6 +436,9 @@ has in any constituent group, it is not necessarily its role in the top group.
 The options `recursive noduplicates` and `includederivedmembership types user` return the same list of users.
 The `includederivedmembership` option makes less API calls but doesn't show level and subgroup information.
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
@@ -430,9 +455,10 @@ gam show cigroup-members
         [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [roles <GroupRoleList>] [members] [managers] [owners]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
-        [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [minimal|basic|full]
+        [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [(depth <Number>) | includederivedmembership]
 ```
 By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -458,6 +484,18 @@ By default, all members, managers and owners in the group are displayed; these o
 By default, all types of members (cbcmbrowser, chromeosdevice, customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
+
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
 * `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
@@ -495,3 +533,7 @@ To show the structure of all groups you can do the following; it will be time co
 ```
 gam redirect stdout ./groups.txt show cigroup-members types group
 ```
+
+## Display external users in groups with allowExternalMembers False
+When printing  group membership, the option `verifyallowexternal` causes
+GAM to only display external users in groups with `allowExternalMembers=False`.

wiki/Cloud-Identity-Groups.md

@@ -267,7 +267,7 @@ gam info cigroups <GroupEntity>
         [nosecurity|nosecuritysettings]
         [allfields|<CIGroupFieldName>*|(fields <CIGroupFieldNameList>)]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [formatjson]
@@ -283,13 +283,17 @@ By default, all direct members, managers and owners in the group are displayed;
 By default, when displaying members from a group, all types of members (customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
@@ -317,11 +321,12 @@ gam print cigroups [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [basic|allfields|(<CIGroupFieldName>* [fields <CIGroupFieldNameList>])]
         [roles <GroupRoleList>] [memberrestrictions]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
         [types <CIGroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 ```
 By default, all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -373,21 +378,34 @@ By default, no members, managers or owners in the group are displayed; these opt
 By default, when displaying members from a group, all types of members (customer, group, serviceaccount, user) in the group are displayed; this option modifies that behavior:
 * `types <CIGroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group.
+
+Members without an email address, e.g. `customer`, `chrome-os-device` and `cbcm-browser` are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
 * `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/GamUpdates.md

@@ -10,6 +10,176 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.32.03
+
+Added option `template` as an additional formating option for `gam <UserTypeEntity> show signature`
+that displays just the HTML data; this simplifies capturing the data for use as input to GAM.
+```
+$ gam redirect stdout ./SigTemplate.html user user@domain.com show signature template
+$ more SigTemplate.html
+<div dir="ltr"><div dir="ltr"><div dir="ltr">
+<p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)">
+<span style="background-color:rgb(82,208,206)">{RT}Email: {Email}{/RT}</span></p>
+<p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)">
+<span style="background-color:rgb(82,208,206)">{RT}Phone: {Phone}{/RT}</span></p>
+<p style="margin:0px;font-size-adjust:none;font-stretch:normal;font-size:12px;line-height:normal;font-family:Monaco;color:rgb(0,0,0)">
+<span style="background-color:rgb(82,208,206)">{RT}Mobile: {Mobile}{/RT}</span></p>
+</div><br></div>\n</div>
+```
+
+### 7.32.02
+
+Added variable `oauth2_txt_lock_mode` to `gam.cfg`, the default is 644 and valid values are: 644, 664, 666.
+This value is used to set the file permissions on the `oauth2.txt.lock` file. In very special cases where
+daemon processes, e.g. Apache/httpd, are running GAM, the value 666 may have to be used.
+
+### 7.32.01
+
+Added option `(addcsvdata <FieldName> <String>)*` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand> csv`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID> csv` that adds additional columns of data to the CSV file output.
+* See: https://github.com/GAM-team/GAM/wiki/ChromeOS-Devices#bulk-action-example
+
+### 7.32.00
+
+Added option `verifyallowexternal` to `gam print cigroup-members|group-members` that causes
+GAM to only display external members in groups with `allowExternalMembers=False'.
+This option can be used to help verify that internal-only groups don't have external members.
+
+Updated option `internaldomains` for the following commands:
+```
+gam info|print groups
+gam print|show group-members
+gam info|print cigroups
+gam print|show cigroup-members
+gam <UserTypeEntity> print|show filesharecounts
+```
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
+
+Added option `csv` to `gam <CrOSTypeEntity> issuecommand command <CrOSCommand>`
+and `gam <CrOSTypeEntity> getcommand commandid <CommandID>` so that command details are displayed in CSV format.
+This can be used to log commands issued to devices and then monitor the results.
+
+Added option `filemimetype category <MimeTypeNameList>` to `gam <UserTypeEntity> copy drivefile` to support
+copying of files based on their MimeType category.
+
+Added option `attendeeslist` to `gam calendars <CalendarEntity> print events` and `gam <UserTypeEntity> print events`
+that causes GAM to display the attendee email addresses in a single column `attendeesList`; no attendee details
+are displayed. The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
+Fixed bug in `gam sendemail ... replyto <EmailAddress>` that caused a message delivery error if
+`<EmailAddress>` did not include a domain name.
+
+Added support for users's chat sections.
+* See: https://github.com/GAM-team/GAM/wiki/Users-Chat#manage-chat-users-sections
+* This is in Deveoper Preview; you must have a `developer_preview_api_key` in `gam.cfg` to use these commands.
+
+### 7.31.06
+
+Added option `batchsize <Integer>` to `gam calendar <CalendarEntity> delete|purge events` and
+`gam <UserTypeEntity> delete|purge events <UserCalendarEntity>` that causes GAM to delete events
+with batch API calls rather than with individual API calls.
+
+### 7.31.05
+
+Added option `variables <RESearchPattern>` to `gam select section <SectionName> verify` and `gam config verify`
+that causes GAM to only display variables with names selected by `<RESearchPattern>`.
+```
+gam select School verify variables "^(customer|domain)"
+Section: School
+  customer_id = C03abc123
+  domain = school.edu
+
+gam config verify variables  'dir'
+Section: DEFAULT
+  cache_dir = ~/GamConfig/gamcache ; /Users/gamteam/GamConfig/gamcache
+  config_dir = ~/GamConfig ; /Users/gamteam/GamConfig
+  drive_dir = ~/GamWork ; /Users/gamteam/GamWork
+  gmail_cse_incert_dir = ~/GmailCSE/Certs ; /Users/gamteam/GmailCSE/Certs
+  gmail_cse_inkey_dir = ~/GmailCSE/Keys ; /Users/gamteam/GmailCSE/Keys
+  input_dir = .
+```
+
+### 7.31.04
+
+Fixed bug in `gam report admin|chrome` that caused to events to not be displayed.
+
+Updated `gam <UserTypeEntity> print|show messages|threads ... query <QueryGmail>` to display the query.
+
+### 7.31.03
+
+Due to the following Calendar API update, the `gam <UserTypeEntity> transfer calendars` command has been removed.
+* See: https://developers.google.com/workspace/calendar/release-notes#October_27_2025
+Data ownership can be transferred in the Google Calendar UI.
+
+### 7.31.02
+
+Added the following options to `gam <UserTypeEntity> copy drivefile`
+to limit copying to those files owned by selected users.
+* `copysubfilesownedby users <EmailAddressList>` - Only files owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby notusers <EmailAddressList>` - Only files not owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby regex <REMatchPattern>` - Only files owned by users whose email addresses match `<REMatchPattern>` are copied.
+* `copysubfilesownedby notregex <REMatchPattern>` - Only files owned by users whose email addresses do not match `<REMatchPattern>` are copied.
+
+### 7.31.01
+
+Code cleanup for `addcsvdata <FieldName> <String>`.
+
+### 7.31.00
+
+Fixed bug in `gam report chrome (user <UserItem>)|(select <UserTypeEntity>)` where no activities were returned.
+`report chrome` does not use the parameter `userKey=<EmailAddress>` as do other applications but requires
+parameter `filter DEVICE_USER==<EmailAddress>`.
+
+Updated `gam report admin (user <UserItem>)|(select <UserTypeEntity>)` to use parameter `filter USER_EMAIL==<EmailAddress>`
+to display activiities affecting the user `<EmailAddress>`. Use option `userisactor` to use the parameter `userKey=<EmailAddress>`
+that displays activities where user `<EmailAddress>` executed the command that generated the activity.
+
+Fixed bug in `gam print cros|filelist|users ... (addcsvdata <FieldName> <String>)+ formatjson` where the `addcsvdata` columns
+were not displayed but the additional field values were included in the JSON data. Now, the `addcsvdata` columns
+are displayed but the additional field values are only included in the JSON data when option `includdecsvdatainjson` is specified.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroups|groups`
+that adds additional columns of data to the CSV file output.
+
+Added option `addcsvdata <FieldName> <String>` to `gam <UserTypeEntity> print cigroupmembere|group-members`
+that adds additional columns of data to the CSV file output.
+
+### 7.30.05
+
+Added option `gmaileventtypes <NumberRangeList>` to `gam report gmail` that can be used to limit the event types displayed.
+```
+<NumberRange> ::= <Number>|(<Number>/<Number>)
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
+
+gam report gmail user user@domain.com gmaileventtypes 1,10/11
+```
+* See: https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gmail
+
+Updated sorting of column headers in `gam report <ActivityApplicationName>`.
+
+### 7.30.04
+
+Updated `gam report gmail` to avoid the following error when incomplete start/end time information is provided.
+```
+ERROR: Invalid request: Start time and end time should both be provided, and the scan duration should not be greater than 30 days.
+```
+* No time information provided - GAM sets `range -30d today`
+* Only `start <Time>`  provided - GAM sets `end <Time>+30d`
+* Only `end <Time>` provided - GAM sets `start <Time>-30d`
+
+### 7.30.03
+
+Updated `gam report <ActivityApplicationName>` to reflect the changes described here:
+* See: https://workspaceupdates.googleblog.com/2025/12/google-workspace-audit-log-api.html
+
+Added option `resourcedetailsfilter <String>` to `gam report <ActivityApplicationName>` described here:
+* See: https://developers.google.com/workspace/admin/reports/reference/rest/v1/activities/list#query-parameters
+
+For `gam <UserTypeEntity> print <Objects>`, expanded the list of `<Objects>` covered by `gam.cfg csv_output_users_audit = True`.
+
 ### 7.30.02
 
 Added option `conferencedata meet <MeetID>` to `<EventAttribute>` that allows specifying
@@ -2821,7 +2991,7 @@ Added option `showmimetype category <MimeTypeNameList>` to `gam <UserTypeEntity>
 <MimeTypeName> ::= application|audio|font|image|message|model|multipart|text|video
 <MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
 
-gam user user@domain.com print filelist fields id,name,mimetype showmimetype prefixes audio,video
+gam user user@domain.com print filelist fields id,name,mimetype showmimetype category audio,video
 ```
 
 ### 6.71.11

wiki/Groups-Membership.md

@@ -615,7 +615,7 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [membernames] [showdeliverysettings]
         <MembersFieldName>* [fields <MembersFieldNameList>]
         [notsuspended|suspended] [notarchived|archived]
@@ -626,6 +626,7 @@ gam print group-members [todrive <ToDriveAttribute>*]
         [(recursive [noduplicates])|includederivedmembership] [nogroupemail]
         [peoplelookup|(peoplelookupuser <EmailAddress>)]
         [unknownname <String>] [cachememberinfo [Boolean]]
+        (addcsvdata <FieldName> <String>)*
         [formatjson [quotechar <Character>]]
 ```
 By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -681,13 +682,21 @@ By default, when displaying members from a group, all members, whether suspended
 * `notsuspended archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
 * `suspended notarchived` - Only include suspended members, this is not common but allows creating groups that allow easy identification of suspended users
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group and adds the column `category` that shows whether the member
+is `external` or `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
@@ -733,6 +742,9 @@ The options `recursive noduplicates` and `includederivedmembership types user no
 The `includederivedmembership` option makes less API calls but doesn't show level and subgroup information.
 Expanding a member of type CUSTOMER may produce a large volume of data as it will display all users in your domain.
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
@@ -752,7 +764,7 @@ gam show group-members
         [descriptionmatchpattern [not] <REMatchPattern>]
         [admincreatedmatch <Boolean>]
         [roles <GroupRoleList>] [members] [managers] [owners] [depth <Number>]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -805,232 +817,17 @@ By default, when displaying members from a group, all members, whether suspended
 By default, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
 * `types <GroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
-
-Members that have met the above qualifications to be displayed can be further qualifed by their email address.
-* `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
-* `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
-
-By default, members of type GROUP are recursively expanded to show their constituent members. (Members of
-type CUSTOMER are not expanded.) The `depth <Number>` argument controls the depth to which nested groups are displayed.
-* `depth -1` - all groups in the selected group and below are displayed; this is the default.
-* `depth 0` - the groups within a selected group are displayed, no descendants are displayed.
-* `depth N` - the groups within the selected group and those groups N levels below the selected group are displayed.
-
-The `includederivedmembership` option causes the API to expand type GROUP and type CUSTOMER
-members to display their constituent members while still displaying the original member.
-
-The options `types user` and `includederivedmembership types user` return the same list of users.
-The `includederivedmembership` option makes less API calls but doesn't show hierarchy.
-Expanding a member of type CUSTOMER may produce a large volume of data as it will display all users in your domain.
-
-### Display group structure
-To see a group's structure of nested groups use the `type group` option.
-```
-$ gam show group-members group testgroup5 types group
-Group: testgroup5@domain.com
-  MEMBER, GROUP, testgroup1@domain.com, ACTIVE
-    MEMBER, GROUP, testgroup2@domain.com, ACTIVE
-  MEMBER, GROUP, testgroup3@domain.com, ACTIVE
-    MEMBER, GROUP, testgroup2@domain.com, ACTIVE
-    MEMBER, GROUP, testgroup4@domain.com, ACTIVE
-```
-To show the structure of all groups you can do the following; it will be time consuming for a large number of groups.
-```
-gam redirect stdout ./groups.txt show group-members types group
-```
-
-### Examples
-#### Print a CSV of all members of a group regardless of role, all fields
-```
-gam print group-members <GroupEntity>
-```
-#### Print a CSV containing all managers emails
-```
-gam print group-members <GroupEntity> role manager fields email
-```
-#### Print a CSV output of all members and their emails only
-```
-gam print group-members <GroupEntity> role member fields email
-```
-#### Display group owners in your domain, but excluding groups where the email starts with a 4 digit code
-```
-gam print group-members domain <Your Domain> emailmatchpattern not '^1234.*' roles owners
-```
-
-
-These options further limit the list of groups selected above:
-* `emailmatchpattern <REMatchPattern>` - Limit display to groups whose email address matches `<REMatchPattern>`
-* `emailmatchpattern not <REMatchPattern>` - Limit display to groups whose email address does not match `<REMatchPattern>`
-* `namematchpattern <REMatchPattern>` - Limit display to groups whose name matches `<REMatchPattern>`
-* `namematchpattern not <REMatchPattern>` - Limit display to groups whose name does not match `<REMatchPattern>`
-* `descriptionmatchpattern <REMatchPattern>` - Limit display to groups whose description matches `<REMatchPattern>`
-* `descriptionmatchpattern not <REMatchPattern>` - Limit display to groups whose description does not match `<REMatchPattern>`
-* `admincreatedmatch True` - Limit display to groups created by administrators
-* `admincreatedmatch False` - Limit display to groups created by users
-
-By default, all members, managers and owners in the group are displayed; these options modify that behavior:
-* `roles <GroupRoleList>` - Display specified roles
-* `members` - Display members
-* `managers` - Display managers
-* `owners` - Display owners
-
-By default, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
-* `types <GroupMemberTypeList>` - Display specified types
-
-By default, members that are groups are displayed as a single entry of type GROUP; this option recursively expands group members to display their user members.
-* `recursive` - Recursively expand group members
-
-When `recursive` is specified, the default is to only display type user members; this option modifies those behaviors:
-* `types <GroupMemberTypeList>` - Display specified types
-
-By default, when displaying members from a group, all members, whether suspended/archived or not, are included.
-* `notsuspended` - Display only non-suspended members
-* `suspended` - Display only suspended members
-* `notarchived` - Do not include archived members
-* `archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `notsuspended notarchived` - Do not include suspended and archived members
-* `suspended archived` - Include only suspended or archived members
-* `notsuspended archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `suspended notarchived` - Only include suspended members, this is not common but allows creating groups that allow easy identification of suspended users
-
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
-
-Members without an email address, e.g. `customer`, are considered internal.
-
-Members that have met the above qualifications to be displayed can be further qualifed by their email address.
-* `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
-* `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
-
-By default, the ID, role, email address, type and status of each member are displayed along with the group email address;
-these options specify which fields to display:
-* `membernames` - Display members full name; an additional API call per member is required
-* `showdeliverysettings` - Display delivery settings; an additional API call per member is required
-* `<MembersFieldName>*` - Individual field names
-* `fields <MembersFieldNameList>` - A comma separated list of field names
-    * `delivery|deliverysettings` - Specify this field to get delivery information; an additional API call per member is required
-
-For members that are users, you can specify additional information to display; an additional API call per member is required
-* `userfields <UserFieldNameList>` - Display specific user fields
-* `allschemas|(schemas|custom|customschemas <SchemaNameList>)` - Display all or specific custom schema values
-
-The additional API calls can be reduced with the `cachememberinfo` option; a single API call is made for each user/group
-and the data is cached to eliminate to need to repeat the API call; this consumes more memory but dramatically reduces the number of API calls.
-
-If member names are requested, names are not available for users not in the domain; you can request that GAM use the People API to retrieve
-names for these users. Names are not retrieved in all cases and success is dependent on what user is used to perform the retrievals.
-* `peoplelookup` - Use the administrator named in oauth2.txt to perform the retrievals
-* `peoplelookupuser <EmailAddress>` - Use `<EmailAddress>` to perform the retrievals
-
-By default, when `membernames` is specified, GAM displays `Unknown` for members whose names can not be determined.
-Use `unknownname <String>` to specify an alternative value.
-
-By default, the group email address is always shown, you can suppress it with the `nogroupemail` option.
-
-The `recursive` option adds two columns, level and subgroup, to the output:
-* `level` - At what level of the expansion does the user appear; level 0 is the top level
-* `subgroup` - The group that contained the user
-
-Displaying membership of multiple groups or recursive expansion may result in multiple instances of the same user being displayed; these multiple instances can be reduced to one entry.
-* `noduplicates` - Reduce multiple instances of the same user to the first instance
-
-The `includederivedmembership` option is an alternative to `recursive`; it causes the API to expand type GROUP and type CUSTOMER
-members to display their constituent members while still displaying the original member.
-The API produces inconsistent results, use with caution.
-
-The options `recursive noduplicates` and `includederivedmembership types user noduplicates` return the same list of users.
-The `includederivedmembership` option makes less API calls but doesn't show level and subgroup information.
-Expanding a member of type CUSTOMER may produce a large volume of data as it will display all users in your domain.
-
-By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
-* `formatjson` - Display the fields in JSON format.
-
-By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
-the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
-When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
-The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
-`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
-
-## Display group membership in hierarchical format
-```
-gam show group-members
-        [([domain|domains <DomainNameEntity>] ([member|showownedby <EmailItem>]|[(query <QueryGroup>)|(queries <QueryGroupList>)]))|
-         (group|group_ns|group_susp <GroupItem>)|
-         (select <GroupEntity>)]
-        [emailmatchpattern [not] <REMatchPattern>] [namematchpattern [not] <REMatchPattern>]
-        [descriptionmatchpattern [not] <REMatchPattern>]
-        [admincreatedmatch <Boolean>]
-        [roles <GroupRoleList>] [members] [managers] [owners] [depth <Number>]
-        [internal] [internaldomains <DomainNameList>] [external]
-        [notsuspended|suspended] [notarchived|archived]
-        [types <GroupMemberTypeList>]
-        [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
-        [includederivedmembership]
-```
-By default, the group membership of all groups in the account are displayed, these options allow selection of subsets of groups:
-* `domain|domains <DomainNameEntity>` - Limit display to groups in the domains specified by `<DomainNameEntity>`
-  * You can predefine this list with the `print_agu_domains` variable in `gam.cfg`.
-* `member <EmailItem>` - Limit display to groups that contain `<EmailItem>` as a member; mutually exclusive with `query <QueryGroup>`
-* `showownedby <EmailItem>` - Limit display to groups that contain `<EmailItem>` as an owner; mutually exclusive with `query <QueryGroup>`
-* `(query <QueryGroup>)|(queries <QueryGroupList>)` - Limit groups to those that match a query; each query is run against each domain
-* `group <GroupItem>` - Limit display to the single group `<GroupItem>`
-* `group_ns <GroupItem>` - Limit display to the single group `<GroupItem>`, display non-suspended members
-* `group_susp <GroupItem>` - Limit display to the single group `<GroupItem>`, display suspended members
-* `select <GroupEntity>` - Limit display to the groups specified in `<GroupEntity>`
-* `showownedby <UserItem>` - Limit display to groups owned by `<UserItem>`
-
-When using `query <QueryGroup>` with the `name:{PREFIX}*` query, `PREFIX` must contain at least three characters.
-
-You can identify groups with the `All users in the organization` member with:
-* `query "memberKey=<CustomerID>"`
-* `member id:<CustomerID>`
-
-These options further limit the list of groups selected above:
-* `emailmatchpattern <REMatchPattern>` - Limit display to groups whose email address matches `<REMatchPattern>`
-* `emailmatchpattern not <REMatchPattern>` - Limit display to groups whose email address does not match `<REMatchPattern>`
-* `namematchpattern <REMatchPattern>` - Limit display to groups whose name matches `<REMatchPattern>`
-* `namematchpattern not <REMatchPattern>` - Limit display to groups whose name does not match `<REMatchPattern>`
-* `descriptionmatchpattern <REMatchPattern>` - Limit display to groups whose description matches `<REMatchPattern>`
-* `descriptionmatchpattern not <REMatchPattern>` - Limit display to groups whose description does not match `<REMatchPattern>`
-* `admincreatedmatch True` - Limit display to groups created by administrators
-* `admincreatedmatch False` - Limit display to groups created by users
-
-By default, all members, managers and owners in the group are displayed; these options modify that behavior:
-* `roles <GroupRoleList>` - Display specified roles
-* `members` - Display members
-* `managers` - Display managers
-* `owners` - Display owners
-
-By default, when displaying members from a group, all members, whether suspended/archived or not, are included.
-* `notsuspended` - Display only non-suspended members
-* `suspended` - Display only suspended members
-* `notarchived` - Do not include archived members
-* `archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `notsuspended notarchived` - Do not include suspended and archived members
-* `suspended archived` - Include only suspended or archived members
-* `notsuspended archived` - Only include archived members, this is not common but allows creating groups that allow easy identification of archived users
-* `suspended notarchived` - Only include suspended members, this is not common but allows creating groups that allow easy identification of suspended users
-
-By default, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
-* `types <GroupMemberTypeList>` - Display specified types
-
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
-
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed

wiki/Groups.md

@@ -396,7 +396,7 @@ gam info group|groups <GroupEntity>
         [basic] <GroupFieldName>* [fields <GroupFieldNameList>] [nodeprecated]
         [ciallfields|(cifields <CIGroupFieldNameList>)]
         [roles <GroupRoleList>] [members] [managers] [owners]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains All|<DomainNameList>] [external]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
@@ -423,13 +423,17 @@ By default, when displaying members from a group, all members, whether suspended
 By default, when displaying members from a group, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
 * `types <GroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your primary workspace domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
@@ -467,13 +471,14 @@ gam print groups [todrive <ToDriveAttribute>*]
         [ciallfields|(cifields <CIGroupFieldNameList>)]
         [nodeprecated]
         [roles <GroupRoleList>]
-        [internal] [internaldomains <DomainNameList>] [external]
+        [internal] [internaldomains all|primary|<DomainNameList>] [external]
         [members|memberscount] [managers|managerscount] [owners|ownerscount] [totalcount] [countsonly]
         [includederivedmembership]
         [notsuspended|suspended] [notarchived|archived]
         [types <GroupMemberTypeList>]
         [memberemaildisplaypattern|memberemailskippattern <REMatchPattern>]
         [convertcrnl] [delimiter <Character>] [sortheaders]
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 ```
 By default, all groups in the account are displayed, these options allow selection of subsets of groups:
@@ -557,21 +562,34 @@ By default, when displaying members from a group, all members, whether suspended
 By default, when displaying members from a group, all types of members (customer, group, user) in the group are displayed; this option modifies that behavior:
 * `types <GroupMemberTypeList>` - Display specified types
 
-By default, when listing group members, GAM does not take the domain of the member into account.
-* `internal internaldomains <DomainNameList>` - Display members whose domain is in `<DomainNameList>`
-* `external internaldomains <DomainNameList>` - Display members whose domain is not in `<DomainNameList>`
-* `internal external internaldomains <DomainNameList>` - Display all members, indicate their category: internal or external
-* `internaldomains <DomainNameList>` - Defaults to value of `domain` in `gam.cfg`
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
-Members without an email address, e.g. `customer`, are considered internal.
+By default, when listing group members, GAM does not take the domain of the member into account.
+* `internal` - Display members whose domain matches a value in `internaldomains`
+* `external` - Display members whose domain does not match value in `internaldomains`
+* `internal external` - Display all members, indicate their category: `internal` or `external`
+
+Members without an email address, e.g. `customer`, are considered `internal`.
+
+When the `internal` or `external` options are specified, GAM adds the  column `allowExternalMembers`
+that shows that setting for the group.
 
 Members that have met the above qualifications to be displayed can be further qualifed by their email address.
 * `memberemaildisplaypattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will be displayed; others will not be displayed
 * `memberemailskippattern <REMatchPattern>` - Members with email addresses that match `<REMatchPattern>` will not be displayed; others will be displayed
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>`
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Home.md

@@ -10,7 +10,36 @@ To run all commands properly, GAM7 requires three things:
 * A special service account that is authorized to act on behalf of your users in order to modify user-specific settings and data such as Drive files, Calendars and Gmail messages and settings like signatures.
 
 # Documentation
-See the sections in the right-hand column for documentation.
+
+## Update History
+A log of updates to GAM7.
+
+## Installation
+Instructions detailing ways of installing GAM7 and alternate installation issues.
+
+## Configuration
+Instructions detailing configuration of GAM7 and alternate authorization methods.
+
+## Notes and Information
+References to resources that enhance your use of GAM7.
+
+## Definitions
+BNF definitions of common items in the GAM7 command syntax.
+
+## Command Processing
+Information regarding use of command line options to control how GAM7 operates.
+
+## Collections
+BNF Syntax definitions of ways to specify multiple Googlw Workspace opjects.
+
+## Client Access
+Syntax, descriptions and examples of commands that are executed by your Google Workspace administrator.
+
+## Special Service Account Access
+How to set up a GAM7 Chat Bot; this is required to use the Chat API to manage Chat Spaces in your Google Workspace.
+
+## Service Account Access
+Syntax, descriptions and examples of commands that are executed on behalf of your Google Workspace users.
 
 # Installation
 * [How to Install GAM7](How-to-Install-GAM7)

wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -252,10 +252,10 @@ writes the credentials into the file oauth2.txt.
 admin@server:/Users/admin$ rm -f /Users/admin/GAMConfig/oauth2.txt
 admin@server:/Users/admin$ gam version
 WARNING: Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /Users/admin/GAMConfig/oauth2.txt, Not Found
-GAM 7.30.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.1 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 
@@ -990,9 +990,9 @@ writes the credentials into the file oauth2.txt.
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
 WARNING: Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: C:\GAMConfig\oauth2.txt, Not Found
-GAM 7.30.02 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.32.03 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.1 64-bit final
+Python 3.14.2 64-bit final
 Windows 11 10.0.26200 AMD64
 Path: C:\GAM7
 Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com

wiki/List-Items.md

@@ -77,6 +77,7 @@
 <MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
 <NamespaceList> ::= "<Namespace>(,<Namespace>)*"
 <NotesNameList> ::= "<NotesName>(,<NotesName>)*"
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
 <OrgUnitList> ::= "<OrgUnitItem>(,<OrgUnitItem>)*"
 <OtherContactsResourceNameList> ::= "<OtherContactsResourceName>(,<OtherContactsResourceName>)*"
 <PeopleResourceNameList> ::= "<PeopleResourceName>(,<PeopleResourceName>)*"

wiki/Meta-Commands-and-File-Redirection.md

@@ -27,12 +27,13 @@ gam [<Select>] [showsections] [<SelectOutputFilter>|<SelectInputFilter>] [<Confi
 Select a section from gam.cfg and process a GAM command using values from that section.
 ```
 <Select> ::=
-        select <Section> [save] [verify]
+        select <Section> [save] [verify [variables <RESearchPattern>]]
 ```
 - `save`
   - Set `section = <Section>` in the `[DEFAULT]` section and write configuration data to gam.cfg
 - `verify`
   - Print the variable values for the selected section
+  - Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
   - Values are determined in this order: Selected section, DEFAULT section, Program default
 
 If you enter `gam select <SectionName>` and nothing else on the command line,
@@ -80,7 +81,7 @@ Set variables in gam.cfg.
 
 ```
 <Config> ::=
-        config (<VariableName> [=] <Value>)* [save] [verify]
+        config (<VariableName> [=] <Value>)* [save] [verify [variables <RESearchPattern>]]
 ```
 - `<VariableName> [=] <Value>`
   - Set `<VariableName> = <Value>` in the current section
@@ -90,6 +91,7 @@ Set variables in gam.cfg.
   - Write configuration data to gam.cfg
 - `verify`
   - Print the variable values for the current section
+  - Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
   - Values are determined in this order: Current section, DEFAULT section, Program default
 
 You can prefix `<Config>` with `<Select>` to set a variable in a particular section.

wiki/Reports.md

@@ -12,10 +12,14 @@
 - [User reports](#user-reports)
 
 ## API documentation
-Changes starting 2025-10-29.
+* [Activity Data Sources](https://support.google.com/a/answer/11482175)
 
+Changes starting 2025-10-29.
 * [Reports API - Admin log event changes](https://support.google.com/a/answer/16601511)
 
+Changes starting 2025-12-20
+* [Reports API - Admin log enhancements](https://workspaceupdates.googleblog.com/2025/12/google-workspace-audit-log-api.html)
+
 These pages show event/parameter names; scroll down in the left column to: Reports.
 
 * [Reports API - Activities](https://developers.google.com/admin-sdk/reports/v1/reference/activities)
@@ -24,6 +28,8 @@ These pages show event/parameter names; scroll down in the left column to: Repor
 
 ## Definitions
 ```
+<NumberRange> ::= <Number>|(<Number>/<Number>)
+<NumberRangeList> ::= "<NumberRange>(,<NumberRange>)*"
 <DayOfWeek> ::= mon|tue|wed|thu|fri|sat|sun
 <Time> ::=
         <Year>-<Month>-<Day>(<Space>|T)<Hour>:<Minute>:<Second>[.<MilliSeconds>](Z|(+|-(<Hour>:<Minute>))) |
@@ -45,54 +51,70 @@ config csv_output_row_filter "'\"accounts:used_quota_in_mb\":count>15000'"
 ## Activity reports
 ```
 <ActivityApplicationName> ::=
+        accessevaluation|
         accesstransparency|access|
         admin|
+        admindataaction|
+        assignments|
         calendar|calendars|
         chat|
         chrome|
         classroom|
+        cloudsearch|
+        contacts|
         contextawareaccess|
+        datamigration|
         datastudio|
+        directorysync|
         drive|doc|docs|
         gcp|cloud|
         geminiinworkspaceapps|gemini|geminiforworkspace|
         gmail|
         gplus|currents|google+|
+        graduation|
         groups|group|
         groupsenterprise|enterprisegroups|
         jamboard|
         keep|
+        ldap|
         login|logins|
         meet|hangoutsmeet|
+        meethardware|
         mobile|devices|
+        profile|
         rules|
         saml|
+        takeout|
+        tasks|
         token|tokens|oauthtoken|
         useraccounts|
         vault
 
 gam report <ActivityApplicationName> [todrive <ToDriveAttribute>*]
         [(user all|<UserItem>)|(orgunit|org|ou <OrgUnitPath> [showorgunit])|(select <UserTypeEntity>)]
+        [userisactor]
         [([start <Time>] [end <Time>])|(range <Time> <Time>)|
          yesterday|today|thismonth|(previousmonths <Integer>)]
         [filter <String> (filtertime<String> <Time>)*]
         [event|events <EventNameList>] [ip <String>]
-        [groupidfilter <String>]
+        [gmaileventtypes <NumberRangeList>]
+        [groupidfilter <String>] [resourcedetailsfilter <String>]
         [maxactivities <Number>] [maxevents <Number>] [maxresults <Number>]
         [countsonly [bydate|summary] [eventrowfilter]]
         (addcsvdata <FieldName> <String>)* [shownoactivities]
 ```
 Select the application with `<ActivityApplicationName>`.
 
-For all `<ActivityApplicationNames>` other than `admin`, select the users for whom information is desired.
+For all `<ActivityApplicationNames>`, select the users for whom information is desired.
 * `user all` - All users, the default; there is one API call
 * `user <UserItem>` - An individual user; there is one API call
 * `orgunit|org|ou <OrgUnitPath>` - All users in the specified OU; there is one API call
   * `showorgunit` - Add a column labelled `actor.orgUnitPath` to the output; an additional API call is made to get the email addresses of the users in `<OrgUnitPath>`
 * `select <UserTypeEntity>` - A selected collection of users, e.g., `select group staff@domain.com`; there is one API call per user
 
-For `<ActivityApplicationName>` `admin`, the users selected are the admins that executed the command, not the targeted user.
-Use `filter "USER_EMAIL==user@domain.com"` to select the targeted user.
+For `<ActivityApplicationName>` `admin` and `chrome`, `orgunit|org|ou <OrgUnitPath>` does not work, use `select ou <OrgUnitPath>`.
+
+For `<ActivityApplicationName>` `admin`, use option `userisactor` to  display activities where the user executed the command that generated the activity.
 
 Limit the time period.
 * `start <Time>`
@@ -103,6 +125,20 @@ Limit the time period.
 * `thismonth` - The current calendar month up to the current time
 * `previousmonths <Integer>` - A number in the range 1 to 6 indicating calendar months previous to the current month
 
+For `gam report gmail`, `start <Time>` and `end <Time>` should both be provided, and the scan duration should not be greater than 30 days.
+GAM will supply missing values:
+* No time information provided - GAM sets `range -30d today`
+* Only `start <Time>`  provided - GAM sets `end <Time>+30d`
+* Only `end <Time>` provided - GAM sets `start <Time>-30d`
+
+For `gam report gmail`, `gmaileventtypes <NumberRangeList>` can be used to limit the event types displayed.
+* See: https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gmail
+
+You can use the following filter to select a specific event; replace `X` with your desired value.
+```
+filter "event_info.mail_event_type==X"
+```
+
 Apply API filters.
 * `filter|filters <String>` - `<String>` is a comma separated list of filter expressions.
 
@@ -111,6 +147,12 @@ The `filtertime<String> <Time>` value replaces the string `#filtertime<String>#`
 The characters following `filtertime` can be any combination of lowercase letters and numbers. This is most useful in scripts
 where you can specify a relative date without having to change the script.
 
+Limit to those users that are a member of at least one of a list of groups.
+* `groupidfilter <String>` - Format: "id:abc123,id:xyz456"
+
+Limit based on resource details.
+* `resourcedetailsfilter <String>` - See: https://developers.google.com/workspace/admin/reports/reference/rest/v1/activities/list#query-parameters
+
 You can use `config csv_output_row_filter` to filter the events if the API filter can't produce the results you want.
 
 Limit to a list of specific events.
@@ -119,9 +161,6 @@ Limit to a list of specific events.
 Limit to a specific IP address.
 * `ip <String>`
 
-Limit to those users that are a member of at least one of a list of groups.
-* `groupidfilter <String>` - Format: "id:abc123,id:xyz456"
-
 Limit the total number of activites.
 * `maxactivities <Number>`
 

wiki/Users-Calendars-Access.md

@@ -145,40 +145,8 @@ The `quotechar <Character>` option allows you to choose an alternate quote chara
 ## Transfer calendar ownership
 
 You can transfer ownership of calendars from one user to another; only non-primary calendars owned by the source user can be transferred.
-```
-gam <UserTypeEntity> transfer calendars|seccals <UserItem> [<UserCalendarEntity>]
-        [keepuser | (retainrole <CalendarACLRole>)] [sendnotifications <Boolean>]
-        [noretentionmessages]
-        [<CalendarSettings>] [append description|location|summary] [noupdatemessages]
-        [deletefromoldowner] [addtonewowner <CalendarAttribute>*] [nolistmessages]
-```
-If `<UserCalendarEntity>` is not specified, all of a user's owned secondary calendars will be transferrdd.
 
-By default, the users in `<UserTypeEntity>` retain no role in the transferred calendars.
-* `keepuser` - The users in `<UserTypeEntity>` retain their ownership.
-* `retainrole <CalendarACLRole>` - The users in `<UserTypeEntity>` retain the specified role.
-* `noretentionmessages` - Suppress the original owner role retention messages.
+This capability is no longer available, see: https://developers.google.com/workspace/calendar/release-notes#October_27_2025
 
-By default, when you add or update a calendar ACL, a notification is sent to the affected users; use `sendnotifications false` to suppress sending the notifications.
+Data ownership can be transferred in the Google Calendar UI.
 
-You can update calendar settings as part of the transfer. In description, location and summary, #email#, #user# and #username# will be replaced
-by the original owner's full email address or just the name portion; #timestamp# will be replaced by the current date and time.
-* `<CalendarSettings>` - The value specified will replace the existing value.
-* `append description|location|summary` - The specified <CalendarSettings> value will be appended to the existing value.
-* `noupdatemessages` - Suppress the settings update messages.
-
-You can manipulate the old and new owner's calendar lists.
-* `deletefromoldowner` - Delete the calendar from the old owner's calendar list
-* `addtonewowner <CalendarAttribute>*` - Add the calendar to the new owner's calendar list; optionally specify attributes
-* `nolistmessages` - Suppress the calendar list add/delete messages.
-
-### Example
-Transfer a secondary calendar from oldowner to newowner. Remove the calendar from the old owner's calendar list and add to the new owner's  calendar list.
-```
-gam user oldowner@domain.com transfer calendars newowner@domain.com c_aaa123zzz@group.calendar.google.com removefromoldowner addtonewowner
-```
-
-Transfer ownership of all non-primary calendars from oldowner to newowner; append a message to the calendar description noting the old owner and the time of transfer.
-```
-gam user oldowner@domain.com transfer calendars newowner@domain.com minaccessrole owner description "(Transferred from #user# on #timestamp#)" append description
-```

wiki/Users-Calendars-Events.md

@@ -596,11 +596,16 @@ Use `jsonattendees file ./attendees.json` in `create/update event`.
 
 ## Delete selected calendar events
 ```
-gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
-gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> delete events <UserCalendarEntity> [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
+gam <UserTypeEntity> purge events <UserCalendarEntity> [<EventEntity>]
+        [batchsize <Integer>] [doit] [<EventNotificationAttribute>]
 ```
 If `<EventEntity>` is not specified, all events in `<UserCalendarEntity>` are selected. This is not typically used.
 
+By default, each event is deleted in a separate API call, use `batchsize` with an integer between 1 and 1000
+to delete the events in batches.
+
 No events are deleted unless you specify the `doit` option; omit `doit` to verify that you properly selected the events to delete.
 
 When events are deleted from a calendar, they are moved to the calendar's trash and are only permanently deleted (purged) after 30 days.
@@ -676,9 +681,10 @@ By default, Gam displays event details, use `countsonly` to display only the num
 
 ```
 gam <UserTypeEntity> print events <UserCalendarEntity> [<EventEntity>] <EventDisplayProperty>*
-        [fields <EventFieldNameList>] [showdayofweek]
+        [fields <EventFieldNameList>] [showdayofweek] [attendeeslist]
         (addcsvdata <FieldName> <String>)*
-        [eventrowfilter]                                                                                          [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
+        [eventrowfilter]
+        [countsonly|(formatjson [quotechar <Character>])] [todrive <ToDriveAttribute>*]
 ```
 In `<EventEntity>`, any `<EventSelectProperty>` options must precede all other options.
 
@@ -689,6 +695,10 @@ option `singleevents` to display all instances of a recurring event.
 
 `showdayofweek` displays columns `start.dayOfWeek` and `end.dayOfWeek` when event start and end times are displayed.
 
+By default, each attendee is displayed in a separate column; `attendeeslist` causes GAM to display
+the attendee email addresses in a single column `attendeesList`; no attendee details are displayed.
+The email addresses are separated by `csv_output_field_delimiter` from `gam.cfg`.
+
 Add additional columns of data from the command line to the output after the calendarId.
 * `addcsvdata <FieldName> <String>`
 

wiki/Users-Chat.md

@@ -7,6 +7,10 @@
 - [Chat Space Permissions](#chat-space-permissions)
 - [Manage Chat Spaces](#manage-chat-spaces)
 - [Display Chat Spaces](#display-chat-spaces)
+- [Manage Chat User Sections](#manage-chat-user-sections)
+- [Display Chat User Sections](#display-chat-user-sections)
+- [Manage Chat User Section Items](#manage-chat-user-section-items)
+- [Display Chat User Section Items](#display-chat-user-section-items)
 - [UI API member role mapping](#ui-api-mwmber-role-mapping)
 - [Manage Chat Members](#manage-chat-members)
 - [Display Chat Members](#display-chat-members)
@@ -30,7 +34,10 @@ gam user user@domain.com update serviceaccount
 [*]  8)  Chat API - Spaces Admin (supports readonly)
 [*]  9)  Chat API - Spaces Delete
 [*] 10)  Chat API - Spaces Delete Admin
+[*] 11)  Chat API - User Sections (supports readonly)
+
 ```
+`Chat API - User Sections` is in Developer Preview; you must have a `developer_preview_api_key` in `gam.cfg` to use these commands.
 
 Added `use_chat_admin_access` Boolean variable to `gam.cfg`. 
 ```
@@ -60,6 +67,7 @@ Google requires that you have a Chat Bot configured in order to use the Chat API
 * [Chat API - Members](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.members/list)
 * [Chat API - Messages](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.messages/list)
 * [Chat API - Events](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.spaceEvents/list)
+* [Chat API - User Sections](https://developers.google.com/workspace/chat/api/reference/rest/v1/users.sections)
 * [Apps in Google Chat](https://support.google.com/chat/answer/7655820)
 * [Manage customemoji permissions](https://support.google.com/a/answer/12850085)
 * [Manage Spaces in Admin Console](https://support.google.com/a/answer/13369245)
@@ -96,6 +104,8 @@ Google requires that you have a Chat Bot configured in order to use the Chat API
 <ChatMember> ::= spaces/<String>/members/<String>
 <ChatMemberList> ::= "<ChatMember>(,<ChatMember>)*"
 <ChatMessage> ::= spaces/<String>/messages/<String>
+<ChatSection> ::= users/<String>/sections/<String> | sections/<String> | section <String>
+<ChatSectionItem> ::= users/<String>/sections/<String>/items/<String> | sections/<String>/items/<String>
 <ChatSpace> ::= spaces/<String> | space <String> | space spaces/<String>
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChatSpaceType> ::=
@@ -422,6 +432,83 @@ When using the `formatjson` option, double quotes are used extensively in the da
 The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
 `quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
 
+## Manage Chat User Sections
+### Create a user's chat section
+```
+gam <UserTypeEntity> create chatsection
+        displayname <String>
+        [formatjson|returnidonly]
+```
+
+### Update a user's chat section
+```
+gam <UserTypeEntity> update chatsection <ChatSection>
+        [displayname <String>]
+        [(sortorder <Integer>)|(position start|end)]
+        [formatjson]
+```
+
+### Delete a user's chat section
+```
+gam <UserTypeEntity> delete chatsection <ChatSection>
+```
+
+## Display Chat User Sections
+### Display information about all of a user's chat sections
+```
+gam <UserTypeEntity> show chatsections
+        [formatjson]
+```
+By default, Gam displays the information as an indented list of keys and values.
+* `formatjson` - Display the fields in JSON format.
+```
+gam <UserTypeEntity> print chatsections [todrive <ToDriveAttribute>*]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
+## Manage Chat User Section Items
+### Move a user's chat section item to a different chat section
+```
+gam <UserTypeEntity> move chatsectionitem <ChatSectionItem> to <ChatSection>
+```
+
+## Display Chat User Section Items
+### Display information about a user's chat section items
+```
+gam <UserTypeEntity> show chatsectionitems <ChatSection>
+        [space <ChatSpace>]
+        [formatjson]
+```
+You can search for a chat section that contains a chat space with:
+`show chatsectionitems sections/- space <ChatSpace>`
+
+By default, Gam displays the information as an indented list of keys and values.
+* `formatjson` - Display the fields in JSON format.
+```
+gam <UserTypeEntity> print chatsectionitems  <ChatSection> [todrive <ToDriveAttribute>*]
+        [space <ChatSpace>]
+        [formatjson [quotechar <Character>]]
+```
+You can search for a chat section that contains a chat space with:
+`print  chatsectionitems sections/- space <ChatSpace>`
+
+By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
 ## UI API member role mapping
 GAM uses the Chat UI role names.
 

wiki/Users-Drive-Copy-Move.md

@@ -41,6 +41,11 @@
 <RESearchPattern> ::= <RegularExpression>
 <RESubstitution> ::= <String>>
 
+<MimeTypeName> ::= application|audio|font|image|message|model|multipart|text|video
+<MimeTypeNameList> ::= "<MimeTypeName>(,<MimeTypeName>)*"
+<MimeType> ::= <MimeTypeName>/<String>
+<MimeTypeList> ::= "<MimeType>(,<MimeType>)*"
+
 <CorporaAttribute> ::= allteamdrives|domain|onlyteamdrives|user
 <DomainName> ::= <String>(.<String>)+
 <DomainNameList> ::= "<DomainName>(,<DomainName>)*"
@@ -99,8 +104,13 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         <DriveFileCopyAttribute>*
         [skipids <DriveFileEntity>]
         [copysubfiles [<Boolean>]] [filenamematchpattern <REMatchPattern>]
-             [filemimetype [not] <MimeTypeList>]
-        [copysubfilesownedby any|me|others]
+             [filemimetype [not] <MimeTypeList>] [filemimetype category <MimeTypeNameList>]
+        [copysubfilesownedby
+            any|me|others|
+            users <EmailAddressList>|
+            notusers <EmailAddressList>|
+            regex <REMatchPattern>|
+            notregex <REMatchPattern>]
         [copysubfolders [<Boolean>]] [foldernamematchpattern <REMatchPattern>]
         [copysubshortcuts [<Boolean>]] [shortcutnamematchpattern <REMatchPattern>]
         [duplicatefiles overwriteolder|overwriteall|duplicatename|uniquename|skip]
@@ -180,6 +190,7 @@ By default, GAM displays a message referencing files and folders not selected fo
 You can specify restrictions on the MIME types to be copied.
 * `filemimetypes <MimeTypeList>` - Copy sub files with the specified MIME types
 * `filemimetypes not <MimeTypeList>` - Copy sub files with MIME types other than those specified 
+* `filemimetypes category <MimeTypeNameList>` - Copy sub files with the specified MIME type categories
 
 ### By default, when copying sub files, folders and shortcuts, all are copied.
 You can specify `<REMatchPattern>` patterns that limit the items copied based on their name.
@@ -188,9 +199,13 @@ You can specify `<REMatchPattern>` patterns that limit the items copied based on
 * `shortcutnamematchpattern <REMatchPattern>` - Only shortcuts whose name matches `<REMatchPattern>` are copied
 
 ### By default, when copying sub files, all files, regardless of ownership, are copied.
-* `copysubfilesownedby any` - All files, regardless of ownership, are copied.
+* `copysubfilesownedby any` - All files, regardless of ownership, are copied; this is the default.
 * `copysubfilesownedby me` - Only files owned by `<UserTypeEntity>`  are copied.
 * `copysubfilesownedby others` - Only files not owned by `<UserTypeEntity>`  are copied.
+* `copysubfilesownedby users <EmailAddressList>` - Only files owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby notusers <EmailAddressList>` - Only files not owned by users in `<EmailAddressList>` are copied.
+* `copysubfilesownedby regex <REMatchPattern>` - Only files owned by users whose email addresses match `<REMatchPattern>` are copied.
+* `copysubfilesownedby notregex <REMatchPattern>` - Only files owned by users whose email addresses do not match `<REMatchPattern>` are copied.
 
 ### Specify a new name for the file/folder
 * `newfilename <DriveFileName>` - The copied file/folder will be named `<DriveFileName>`

wiki/Users-Drive-Files-Display.md

@@ -752,7 +752,7 @@ The option `showlastmodification` displays the following fields:
 `lastModifiedFileId,lastModifiedFileName,lastModifiedFileMimeType,lastModifiedFilePath,lastModifyingUser,lastModifiedTime`;
 these are for the most recently modified file.
 
-For print filecouts, add additional columns of data from the command line to the output:
+For print filecounts, add additional columns of data from the command line to the output:
 * `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
 
 See [Select files for Display file counts, list, tree](#select-files-for-display-file-counts-list-tree)
@@ -880,11 +880,11 @@ Print or show the share type counts of a user's files. These fields are displaye
 ```
 gam <UserTypeEntity> print filesharecounts [todrive <ToDriveAttribute>*]
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 gam <UserTypeEntity> show filesharecounts
         [excludetrashed]
-        [internaldomains <DomainNameList>]
+        [internaldomains all|primary|<DomainNameList>]
         [summary none|only|plus] [summaryuser <String>]
 ```
 
@@ -892,8 +892,10 @@ By default, print|show filesharecounts displays share type counts of all files o
 
 Use the `excludetrashed` option to suppress counting files in the trash.
 
-By default, `internaldomains <DomainNameList>` defaults to your primary domain; if you have other domains that
-you consider internal, list all of them in `<DomainNameList>`.
+Which domains are considered internal domains:
+  * `internaldomains all` - All of your workspace domains; this is the default
+  * `internaldomains primary` - Your workspace primary domain
+  * `internaldomains <DomainNameList>` - A list of domain names
 
 By default, share type counts for individual users are displayed; the `summary` option offers alternatives
 that can display a summarization of share type counts across all users specified in the command.
@@ -1103,7 +1105,7 @@ gam <UserTypeEntity> print|show filelist [todrive <ToDriveAttribute>*]
         [showparentsidsaslist] [showpermissionslast]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])* [delimiter <Character>]
         [stripcrsfromname]
-        (addcsvdata <FieldName> <String>)*
+        (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [formatjson [quotechar <Character>]]
 ```
 By default, `print filelist` displays all files owned by the specified [`<UserTypeEntity>`](https://github.com/GAM-team/GAM/wiki/Collections-of-Users)
@@ -1214,7 +1216,6 @@ If no query or select is performed, use these options to get file path informati
 * `filepath|fullpath` - For files and folders, display the full path(s) to them starting at the root (My Drive)
 * `addpathstojson` - When this option and `formatjson` are specified, the path information will be included in the
 JSON data rather than as additional columns
-* `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
 
 When used with `filepath` or `fullpath`, `showdepth` will display a `depth` column.
 Files/folders directly in `My Drive` are at depth 0, the depth increases by 1
@@ -1308,9 +1309,15 @@ Use the `countsrowfilter` option to have GAM to apply `config csv_output_row_fil
 The `stripcrsfromname` option strips nulls, carriage returns and linefeeds from drive file names.
 This option is special purpose and will not generally be used.
 
+Add additional columns of data from the command line to the output
+* `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
+
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
 the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
 When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.

wiki/Users-Gmail-Send-As-Signature-Vacation.md

@@ -116,7 +116,7 @@ gam <UserTypeEntity> show sendas [compact|format|html]
 ```
 
 These are the output formatting options:
-* `compact` - Escape carriage returns as \r and newlines as \n in original HTML; this format produces output that can be used as input to GAM
+* `compact` - Escape carriage returns as \r and newlines as \n in original HTML
 * `format` - Strip HTML keywords leaving basic printable information
 * `html` - Show original HTML; this is the default option; the output is human readable but cannot be used as input to GAM
 
@@ -184,12 +184,13 @@ If you have a current default signature, the API will update that, but if you de
 ## Display signature
 ### Display the signature as an indented list of keys and values.
 ```
-gam <UserTypeEntity> show signature|sig [compact|format|html]
+gam <UserTypeEntity> show signature|sig [compact|format|html|template]
         [primary|default] [verifyonly]
 ```
 
 These are the output formatting options:
-* `compact` - Escape carriage returns as \r and newlines as \n in original HTML; this format produces output that can be used as input to GAM
+* `template` - Escape carriage returns as \r and newlines as \n in original HTML; this format produces output that can be used as input to GAM
+* `compact` - Escape carriage returns as \r and newlines as \n in original HTML
 * `format` - Strip HTML keywords leaving basic printable information
 * `html` - Show original HTML; this is the default option; the output is human readable but cannot be used an input to GAM
 
@@ -295,19 +296,10 @@ Use text like `{FirstName}` and `{Email}` in the locations where the actual valu
 
 Once you're created the template signature, do the following:
 ```
-$ gam user testuser@domain.com show signature compact > SimpleSig.html
-$ more SimpleSig.html
-SendAs Address: <testuser@domain.com>
-  IsPrimary: True
-  Default: True
-  Signature: <div dir="ltr">--<div>Name: {FirstName} {LastName}<div>Phone: {Phone}</div><div>Email: {Email}</div></div><div><br></div><div>Company Name</div><div>Company Address</div><div><br></div></div>\n
-```
-Edit SimpleSig.html and delete all text from `SendAs ` through `Signature: `.
-The result should be:
-```
+$ gam redirect stdout ./SigTemplate.html user testuser@domain.com show signature template
+$ more SigTemplate.html
 <div dir="ltr">--<div>Name: {FirstName} {LastName}<div>Phone: {Phone}</div><div>Email: {Email}</div></div><div><br></div><div>Company Name</div><div>Company Address</div><div><br></div></div>\n
 ```
-
 This is a sample Users.csv file.
 ```
 email,first,last,phone
@@ -317,5 +309,20 @@ mjones@domain.com,Mary,Jones,510-555-1212 x 456
 
 This command will update the user's signatures.
 ```
-gam csv Users.csv gam user "~email" signature htmlfile SimpleSig.html replace FirstName "~first"  replace LastName "~last" replace Phone "~phone" replace Email "~email"
-```
+gam csv Users.csv gam user "~email" signature htmlfile SigTemplate.html replace FirstName "~first"  replace LastName "~last" replace Phone "~phone" replace Email "~email"
+```
+
+You can also do the update with user attributes:
+
+This is a sample Users.csv file.
+
+```
+email
+bsmith@domain.com
+mjones@domain.com
+```
+
+This command will update the user's signatures.
+```
+gam csv Users.csv gam user "~email" signature htmlfile SigTemplate.html replace FirstName field:name.givenname replace LastName field:name.familyname replace Phone field:phone.value.type.work replace Email field:email.primaryemail
+```

wiki/Users.md

@@ -1058,7 +1058,7 @@ gam print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 ```
 
 By default, users in all domains in the account are selected; these options allow selection of subsets of users:
@@ -1084,7 +1084,7 @@ gam print users [todrive <ToDriveAttribute>*] select <UserTypeEntity>
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 
 gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         [orderby <UserOrderByFieldName> [ascending|descending]]
@@ -1098,7 +1098,7 @@ gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
         [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
-        [showvalidcolumn] (addcsvdata <FieldName> <String>)*
+        [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 ```
 
 By default, Gam gets no group membership information for each user. The `groups` and `groupsincolumns`
@@ -1167,6 +1167,9 @@ Add additional columns of data from the command line to the output
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format:
 * `formatjson` - Display the fields in JSON format.
 
+If `formatjson` and `addcsvdata` are specified, the option `includecsvdatainjson` causes GAM to add the
+additional field values to the JSON data.
+
 When you perform `gam print users` with the following `todrive` options to update a sheet within a Google Sheets file:
 `tdfileid <DriveFileID> tdsheet <SheetEntity> tdupdatesheet`
 and your data includes international phone numbers that start with a plus sign, Google Sheets generates a `Formula parse error`

wiki/Version-and-Help.md

@@ -3,22 +3,22 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.30.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.1 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
-Time: 2023-06-02T21:10:00-07:00
+Time: 2025-12-23T13:57:00-08:00
 ```
 
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.30.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.1 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Your system time differs from www.googleapis.com by less than 1 second
@@ -27,13 +27,13 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.30.02 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.32.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.1 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
-Time: 2023-06-02T21:10:00-07:00
+Time: 2025-12-23T13:57:00-08:00
 Your system time differs from admin.googleapis.com by less than 1 second
 OpenSSL 3.5.3 16 Sep 2025
 arrow 1.3.0
@@ -68,7 +68,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/Admin/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.30.02
+   Latest: 7.32.03
 echo $?
 1
 ```
@@ -76,7 +76,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.30.02
+7.32.03
 ```
 In Linux/MacOS you can do:
 ```
@@ -86,13 +86,13 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.30.02 - https://github.com/GAM-team/GAM
+GAM 7.32.03 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.1 64-bit final
-macOS Tahoe 26.1 x86_64
+Python 3.14.2 64-bit final
+macOS Tahoe 26.2 x86_64
 Path: /Users/Admin/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
-Time: 2023-06-02T21:10:00-07:00
+Time: 2025-12-23T13:57:00-08:00
 Help: Syntax in file /Users/Admin/bin/gam7/GamCommands.txt
 Help: Documentation is at https://github.com/GAM-team/GAM/wiki
 ```

wiki/_Sidebar.md

@@ -33,6 +33,7 @@ Notes and Information
 * [Questions? Visit the GAM Discussion Forum](https://groups.google.com/forum/#!forum/google-apps-manager)
 * [GAM Public Chat Room](GAM-Public-Chat-Room)
 * [Scripts](Scripts)
+* [Code Wiki](https://codewiki.google/github.com/gam-team/gam)
 * [Other Resources](Other-Resources)
 * [Drive REST API v3](Drive-REST-API-v3)
 * [BNF Syntax](BNF-Syntax)

wiki/foo.lst

@@ -1 +0,0 @@
-ChromeOS-Devices.md Classroom-Courses.md Classroom-Membership.md Classroom-StudentGroups.md Cloud-Identity-Devices.md Cloud-Identity-Groups.md Domains.md GamUpdates.md Groups.md Mobile-Devices.md Organizational-Units.md Resources.md Shared-Drives.md Users-Shared-Drives.md Users.md

wiki/gam.cfg.md

@@ -1,6 +1,7 @@
 # GAM Configuration
 - [Introduction](#introduction)
 - [Variables](#variables)
+- [Set configuration variables](#set-configuration-variables)
 - [Multiple Computers](#multiple-computers)
 - [Separate Staff-Student Domains](#separate-staff-student-domains)
 - [Multiple Customers and Domains](#multiple-customers-and-domains)
@@ -276,7 +277,8 @@ csv_output_row_limit
         Default: 0
 csv_output_sort_headers
         A list of column headers that causes GAM to sort CSV output rows by those headers.
-        The column headers are case insensitive and if column header does not appear in the CSV output, it is ignored.
+        The column headers are case insensitive and if column header does not appear in the CSV output,
+        it is ignored.
         Default: Blank
 csv_output_subfield_delimiter
         Character used to delimit fields and subfields in headers when writing CSV files;
@@ -290,8 +292,6 @@ csv_output_timestamp_column
 csv_output_users_audit
         Gam print commands that print objects belonging to users
         don't print rows for users that don't have any of the objects.
-        The objects are: calendars, calendar ACLs, calendar events, delegates, filters,
-        forwarding addresses, sendas addresses, S/MIME certificates and tokens.
         When csv_output_users_audit is true, a placeholder row will be output with the
         user's email address; these rows will useful for auditing purposes only,
         they can not be successfuly used in a gam csv command.
@@ -343,7 +343,8 @@ enable_dasa
         customer_id may not be set to my_customer
         Signal file: OldGamPath/enabledasa.txt
 enforce_expansive_access
-        The default value for option `enforceexpansiveaccess` in all commands that delete or update drive file ACLs/permissions.
+        The default value for option `enforceexpansiveaccess` in all commands that delete or update
+        drive file ACLs/permissions.
         gam <UserTypeEntity> delete permissions
         gam <UserTypeEntity> delete drivefileacl
         gam <UserTypeEntity> update drivefileacl
@@ -365,7 +366,8 @@ gmail_cse_incert_dir
         Directory for the S/MIME certificate files used by Gmail Client Side Encryption.
         Default: Blank
 gmail_cse_inkey_dir
-        Directory for the Key Access Control List (KACL) wrapped private key data files used by Gmail Client Side Encryption.
+        Directory for the Key Access Control List (KACL) wrapped private key data files used by
+        Gmail Client Side Encryption.
         Default: Blank
 input_dir
         Input directory for files with non-absolute file names.
@@ -382,7 +384,8 @@ license_max_results
         Range: 10 - 1000
 license_skus
         A comma separated list of license SKUs; when getting licenses, only these SKUs will be processed.
-        Each item in the list can be a <SKUID> which will be validated or <ProductID>/<SKUID> which will not
+        Each item in the list can be a <SKUID> which will be validated or
+        a <ProductID>/<SKUID> which will not be validated.
         Default: Blank
 meet_v2_beta
         Enable/disable use of Meet API v2 beta for additional Chat Space parameters.
@@ -460,6 +463,10 @@ oauth2_txt
         Path to oauth2.txt
         Default: GamConfigDir/oauth2.txt
         Environment variable: OAUTHFILE
+oauth2_txt_lock_mode
+        Allowed values: 644, 664, 666
+        File permissions for oauth2.txt.lock
+        Default: 644
 oauth2service_json
         Path to oauth2service.json
         Default: GamConfigDir/oauth2service.json
@@ -500,8 +507,9 @@ print_cros_ous_and_children
         This allows predefining the list of org units so they don't have to be specified in each command.
         Default: Blank
 process_wait_limit
-        When processing batch/CSV files, how long (in seconds) GAM should wait for all batch|csv processes to complete
-        after all have been started. If the limit is reached, GAM terminates any remaining processes.
+        When processing batch/CSV files, how long (in seconds) GAM should wait for all
+        batch|csv processes to complete after all have been started.
+        If the limit is reached, GAM terminates any remaining processes.
         Default: 0: no limit
         Range: 0 - Unlimited
 quick_cros_move
@@ -582,10 +590,12 @@ tls_min_version
         The minimum TLS version to use in https connections
         Default: ''
 todrive_clearfilter
-        Enable/disable clearing the spreadsheet basic filter when uploading data to an existing sheet in an existing file.
+        Enable/disable clearing the spreadsheet basic filter when uploading data to an existing sheet in
+        an existing file.
         Default: False
 todrive_clientaccess
-        Enable/disable use of client access rather than service account access when uploading files with todrive
+        Enable/disable use of client access rather than service account access when uploading files
+        with todrive
         Default: False
 todrive_conversion
         Enable/disable conversion of CSV files to Google Sheets when todrive is specified
@@ -636,8 +646,9 @@ todrive_user
         Email address of user to receive CSV files when todrive is specified
         Default: '' which becomes admin user in admin_email or address from oauth2.txt
 truncate_client_id
-        Prior to version 6.74.00, GAM stripped '.apps.googleusercontent.com' from the client_id in oauth2.txt
-        and passed the truncated value in API calls; this is no longer performed unless truncate_client_id is true
+        Prior to version 6.74.00, GAM stripped '.apps.googleusercontent.com' from the client_id
+        in oauth2.txt and passed the truncated value in API calls; this is no longer performed
+        unless truncate_client_id is true
         Default: False
 update_cros_ou_with_id
         Update the OU of a Chromebook with the OU ID rather than the OU path.
@@ -675,7 +686,7 @@ user_service_account_access_only
 ```
 This is sample output:
 ```
-$gam select default verify.
+$gam select default verify
 Config File: /Users/admin/.gam/gam.cfg, Initialized
 Section: DEFAULT
   activity_max_results = 100
@@ -802,6 +813,33 @@ Section: DEFAULT
   user_service_account_access_only = false
 ```
 
+## Set configuration variables
+You can set variables in gam.cfg with an editor or from the command line with GAM.
+
+```
+<Config> ::=
+        config (<VariableName> [=] <Value>)* [save] [verify [variables <RESearchPattern>]]
+```
+- `<VariableName> [=] <Value>`
+  - Set `<VariableName> = <Value>` in the current section
+  - All `<VariableNames>` except section are allowed.
+  - The `=` is optional but must be surrounded by spaces if included.
+- `save`
+  - Write configuration data to gam.cfg
+- `verify`
+  - Print the variable values for the current section
+  - Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
+  - Values are determined in this order: Current section, DEFAULT section, Program default
+
+You can prefix `<Config>` with `<Select>` to set a variable in a particular section.
+* `select default <Config>` - Set a variable in the `DEFAULT` section
+* `select xyz <Config>` - Set a variable in the `xyz` section
+
+For example, to set yiur workspace Customer ID and domain name:
+```
+gam config customer_id C0123abc domain mydomain.org save
+```
+
 ## Multiple Computers
 You can install GAM on multiple computers, all using the same project. After installing GAM on your
 initial computer, follow these quidelines.
@@ -849,7 +887,7 @@ it's how you quickly switch from from one client to another.
 
 The arguments are optional, must appear in this order and must be the first arguments before any other GAM arguments.
 ```
-select <Section> [save] [verify]
+select <Section> [save] [verify [variables <RESearchPattern>]]
         Use <Section> from gam.cfg for the current GAM command.
         <Section> is case-sensitive except for DEFAULT which is case-insensitive.
     save
@@ -857,6 +895,7 @@ select <Section> [save] [verify]
         Write configuration data to gam.cfg
     verify
         Print the variable values for the current section
+        Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
         Values are determined in this order: Current section, DEFAULT section, Program default
 ```
 Display all of the sections in gam.cfg and mark the currently selected section with a *.
@@ -865,7 +904,7 @@ showsections
 ```
 The config argument is used to set selected variables in gam.cfg via the command line.
 ```
-config [<VariableName> [=] <Value>]* [save] [verify]
+config [<VariableName> [=] <Value>]* [save] [verify [variables <RESearchPattern>]]
     <VariableName> [=] <Value>
         Set <VariableName> = <Value> in the current section
         All <VariableNames> except section are allowed.
@@ -874,6 +913,7 @@ config [<VariableName> [=] <Value>]* [save] [verify]
         Write configuration data to gam.cfg
     verify
         Print the variable values for the current section
+        Use `variables <RESearchPattern>` to display variables with names selected by `<RESearchPattern>`
         Values are determined in this order: Current section, DEFAULT section, Program default
 
 redirect csv <FileName> [multiprocess] [append] [noheader] [charset <Charset>] [columndelimiter <Character>]