get_user
Look up one named Google Workspace account to diagnose sign-in failures: suspension reason, archive status, 2-step verification, last login, org unit, and pending password change.
Instructions
Look up ONE named account's current state — the "why can't this person sign in" tool.
Answers a helpdesk ticket that already names the exact address: is the account suspended (and for what reason, since when), archived, enrolled in or enforced into 2-step verification, when did it last log in, which org unit is it in, is a password change pending. One Directory API request, no pagination.
Use this — not suspended_accounts — whenever the address is known.
That tool lists only accounts that ARE suspended, so it can never confirm
that a given address is not suspended, and once that list exceeds its
page cap absence stops being evidence either way — after spending far more
API calls than this. suspended_accounts is for the domain-wide sweep it
is actually named for.
This directory is downstream of the identity provider, not the master. Read
the answer as "what Google Workspace currently believes about this account"
and compare it against the IdP's own record, which is authoritative for who
the account is. A disagreement is usually drift on this side rather than a
mistyped address — an account the IdP still authenticates can be suspended
or archived here, and an address the IdP does not assert at all will simply
come back found: false.
An address that names no account returns found: false with no state
fields. That is a normal, expected answer — a typo'd or long-deleted
address — and is itself the diagnostic result, NOT a failure. A missing
DWD scope, a rejected credential or a transient API failure is reported as
{"error": ...} instead. The two are deliberately distinct: never read
found: false as "the lookup did not work", and never read an error
as evidence about whether the account exists.
Read-only (Directory API users().get; this tool never changes the
account). Requires the admin.directory.user.readonly DWD scope —
the same one suspended_accounts uses, so a tenant already running that
tool needs no additional grant.
Args:
username: Exact user email, passed through as the Directory API
userKey (primary or alias address both work on Google's side;
the returned email is the account's canonical primary one).
domain: Configured [domain.*] section to route the lookup through.
Default: resolved from the username's suffix. Set it explicitly
when the address uses an alias/secondary domain that has no
config section of its own (common when copying addresses from
mail headers or IdP logs).
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"username": "<username>"
},
"name": "get_user"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | ||
| username | Yes |