Google Groups: checking who can add external members via the API

On mailing lists that include business partners or contractors, can group owners freely add outside addresses? The IT team may want to know, but opening groups one at a time in the Admin console to check is not realistic once the number grows. If you read group settings in bulk with a script or admin tool, it is worth checking whether that output includes "who can add external people."

The definition (Discovery document) of the Groups Settings API, which reads and writes Google Workspace group settings, includes a field called whoCanAddExternalMembers. It has two values: "only admins can add" and "end users can add." On February 23, 2026, Google announced a change that tightens how groups are classified as "internal" or "external," and said that a sub-setting to "restrict adding external members to admins only" would be added to the Admin console. This field appears to be for reading and writing that setting through the API. However, the copies of the definition stored in Google's published client libraries for Go and Python do not yet include this field. In this article, we show the differences between the original definition and those copies, then cover its relationship with the existing allowExternalMembers, how to take inventory of current settings, and caveats for each library.

whoCanAddExternalMembers appears in the definition

In the Groups Settings API Discovery document retrieved on October 10, 2026, the Groups fields that represent group settings include the following description.

Specifies who can add external members. UPDATE and PATCH requests ignore this field if allowExternalMembers is false. Possible values are:

• ONLY_ADMINS_CAN_ADD_EXTERNAL_MEMBERS
• END_USERS_CAN_ADD_EXTERNAL_MEMBERS

In other words: "Specifies who can add external members. If allowExternalMembers is false, UPDATE and PATCH requests ignore this field." The type is string, and it has the following two values.

• ONLY_ADMINS_CAN_ADD_EXTERNAL_MEMBERS (judging by the name, only admins can add external members)
• END_USERS_CAN_ADD_EXTERNAL_MEMBERS (judging by the name, end users can also add external members)

The definition only gives the value names. It does not explain which roles count as "admins," or whether "end users" means only owners or also regular members. The notes in parentheses reflect only what can be inferred from the names.

Reading and writing use the existing groups.get, groups.patch and groups.update, and the scope is still https://www.googleapis.com/auth/apps.groups.settings. The developer reference (updated September 3, 2026) also lists this field with the same wording in its description of the groups resource.

What we know about when it was added

Not in the client copies

We compared the copies of the Discovery document stored in Google's client library repositories with the document as of October 10.

• groupssettings/v1/groupssettings-api.json in googleapis/google-api-go-client (last updated June 20, 2024, commit 20ffdd8000)
• groupssettings.v1.json in googleapis/google-api-python-client (last updated June 25, 2024, commit 979de72f)
• groupssettings.v1.json in googleapis/discovery-artifact-manager (last updated July 1, 2024. The repository itself was updated daily through October 9, 2026)

For all three copies, after normalizing the formatting, there were only two differences. One is the addition of whoCanAddExternalMembers. The other is that one sentence was removed from the description of ANYONE_CAN_JOIN in whoCanJoin, which represents permission to join: "If you later disable this option, any external addresses already added to users’ groups remain in those groups." The definition gives no reason, but the February 2026 announcement described below says that switching a group to internal will now remove external members, which is consistent with this sentence being removed. The description of allowExternalMembers has not changed.

The revision number has not changed

The revision that indicates the Discovery document revision is still 20220614 in both the copies and the current document. A mechanism that detects definition changes by watching the revision number will not notice this addition. The fact that the copies have not been updated since June 2024 may also be related to the revision not changing, but this is speculation.

Therefore, we can only say that the field was added to the definition at some point between "not present in the copies retrieved in June 2024" and "present in the document on October 10, 2026."

Relationship with the February 2026 announcement

On February 23, 2026, the Google Workspace Updates blog announced a change that tightens how Google Groups are classified as internal or external. Combined with the Admin Help article (updated October 13, 2026), the main points are as follows.

• Groups with the setting that allows members outside the organization (Allow members outside your organization in the English interface) turned off (internal groups) can only contain members from within the organization. Previously, external people could get in through additions by admins or by nesting groups that contained external members
• This setting is renamed "Allow external members in the group," and a sub-setting is added to restrict adding external members to group admins only
• Groups that are currently internal but have external members will be reclassified as external groups, with the setting that only admins can add external members
• When a group is switched from external to internal, external people who are direct members are removed completely
• The timing is given as "Q2 2026" and "on or after May 15, 2026," and it applies to all Google Workspace customers

The announcement and Help article do not mention the field name whoCanAddExternalMembers, but the Help article says the classification can be changed with the "updated Groups Settings API." Based on the field description and the value names, the editorial team has concluded that this field corresponds to the sub-setting.

We have not been able to confirm the following points.

• The field's default value (what is returned for groups where the value has not been set)
• Whether the change has actually been applied (even as of its October 13 update, the Help article still says it "starts in Q2 2026," and we found no announcement saying it has been applied)

Relationship with allowExternalMembers

Based on the definition's descriptions, the fields related to external members are as follows.

• allowExternalMembers: whether users outside the organization can become members of the group. The value is the string "true" / "false"
• whoCanAddExternalMembers: who can add external members. When allowExternalMembers is false, updates to it are ignored
• whoCanModerateMembers: who can manage members (ALL_MEMBERS, OWNERS_AND_MANAGERS, OWNERS_ONLY, NONE)

As the editorial team reads it, this works in two stages: allowExternalMembers decides "whether outside people may be added," and for groups where they may, whoCanAddExternalMembers decides "who is entrusted with that operation." Permissions for delegating member management to department staff were covered in our article on removing custom roles for group member management. We have not verified on actual groups who can actually do what when the three fields are combined.

One more point: if the change has been applied as announced, setting allowExternalMembers to false is no longer simply an operation that means "do not add outside people from now on." External people who are direct members are removed from the group, and they are not restored automatically even if you change it back (the Help article says direct members must be added again manually).

Note the wording "ignore." If you PATCH only whoCanAddExternalMembers on a group where allowExternalMembers is false, the change may not take effect, without any error. The definition also does not make clear whether the change takes effect if allowExternalMembers is set to true in the same request. After updating, always read the settings back with groups.get to confirm the value.

Taking inventory of current settings

Reading the group list and settings

Get the list of groups in your organization with groups.list in the Admin SDK Directory API (specify my_customer for customer; up to 200 per call). For read-only access, https://www.googleapis.com/auth/admin.directory.group.readonly is enough. Read each group's settings with groups.get in the Groups Settings API.

Here is an example that uses the Python client to export each group's external member settings to CSV.

# グループごとの外部メンバーの設定を CSV に出す（編集部の例。実際のAPIでは未検証）
import csv, sys
from googleapiclient.discovery import build

def audit(creds):
    directory = build("admin", "directory_v1", credentials=creds)
    settings = build("groupssettings", "v1", credentials=creds)
    out = csv.writer(sys.stdout)
    out.writerow(["email", "allowExternalMembers", "whoCanAddExternalMembers", "whoCanModerateMembers"])
    token = None
    while True:
        page = directory.groups().list(customer="my_customer", maxResults=200, pageToken=token).execute()
        for g in page.get("groups", []):
            s = settings.groups().get(groupUniqueId=g["email"]).execute()
            out.writerow([g["email"], s.get("allowExternalMembers"),
                          s.get("whoCanAddExternalMembers", "(返ってこない)"),
                          s.get("whoCanModerateMembers")])
        token = page.get("nextPageToken")
        if not token:
            break

For groups where the field is not returned, record it as "not returned" rather than leaving it blank. Because the default value is unknown, this avoids reading a blank as either "admins only" or "anyone."

Some libraries drop the field

We checked how the missing field in the definition copies affects actual scripts. On a local PC, we set up a test server that returns responses containing whoCanAddExternalMembers, and called groups.get and groups.patch from each library (without connecting to Google's APIs).

If you take inventory with the Go client, the field may not appear in the output even when Google returns a value, and you may wrongly conclude that it is "not set." When working in Go, consider calling the API directly with an HTTP client and reading the JSON.

One more point: in the definition, the default value of alt, which specifies the response format, is atom (XML). In our tests, the Go and Python clients added alt=json automatically, but the Node.js client did not. In Node.js, it is safer to specify alt: 'json' explicitly. We have not checked what the actual API returns when alt is omitted.

For Apps Script, Google's official samples (googleworkspace/apps-script-samples) show an example that uses the advanced service AdminGroupsSettings to read settings with AdminGroupsSettings.Groups.get(groupId). We have not been able to confirm whether this service's return value includes the new field.

What to decide before changing settings

Before aligning settings based on the inventory results, decide the following as an admin.

1. Decide which groups may include outside people. Set allowExternalMembers to true only for groups that need external members, such as those used to communicate with business partners. Setting a group that currently has external members to false removes those people, so complete the check in step 4 first. How to use groups for different purposes is covered in How to create and use Google Groups, and the overall approach to collaborating with people outside the company is covered in Collaborating with guest accounts
2. Decide who is entrusted with adding outside people. For each group that includes outside people, decide on a policy: admins only if the IT team manages it, or also allow end users if it is delegated to a department
3. Try it on a test group. Before changing production groups, PATCH a test group and then read it back with groups.get to confirm whether the value takes effect and how the Admin console display changes
4. Check existing external members separately. whoCanAddExternalMembers is a setting for "who can add people from now on." Get member addresses with members.list in the Directory API, list those outside your company's domain, and confirm whether they are needed. According to the Help article, external members who come through nested groups will be excluded from internal groups

Because the field was added without the Discovery document revision number changing, if you track changes to the definition, it is more reliable to periodically fetch the document contents and compare them than to rely on the revision number.

Scope of verification

On October 10, 2026, we retrieved the Groups Settings API Discovery document (https://www.googleapis.com/discovery/v1/apis/groupssettings/v1/rest, revision 20220614) and compared it with the copies stored in googleapis/google-api-go-client (commit 20ffdd8000), googleapis/google-api-python-client (commit 979de72f), and googleapis/discovery-artifact-manager (document research). We also set up a test server on a local PC (Linux) to check whether the Go, Python, and Node.js client libraries keep and send the field (verification of library behavior, without connecting to Google's APIs). On October 16, 2026, we reviewed the Groups Settings API developer reference, the February 23, 2026 announcement on the Workspace Updates blog, and the Admin Help article (document research). We have not verified API calls on an actual Google Workspace environment, the field's default value, whether the change has been applied, or the return value of the Apps Script advanced service. The correspondence between the announced sub-setting and whoCanAddExternalMembers is a judgment based on the field description and the value names. The approach to deciding settings and the inventory method are the editorial team's suggestions.

For group design, inventorying external members, or reviewing admin settings, please contact us through our free IT and Google Workspace consultation.

References

• Groups Settings API Discovery document
• googleapis/google-api-go-client — groupssettings/v1/groupssettings-api.json
• googleapis/google-api-python-client — groupssettings.v1.json
• googleapis/discovery-artifact-manager — groupssettings.v1.json
• Admin SDK Directory API Discovery document
• googleworkspace/apps-script-samples — advanced/adminSDK.gs
• Groups Settings API reference — groups
• Google Workspace Updates — New internal and external membership classifications for Google Groups (February 23, 2026)
• Google Workspace Admin Help — Changes to internal & external classifications in Google Groups