Google Drive API V3: Creating file permissions for a domain

Question

Trying to add permissions to a file via Google Drive's API V3 and I ran into the error below. I want to allow requests from mta.io, my site, to able to read the file. The error seems to come from what domain I pass in the body of request for example, example.com works fine and permissions are granted to it. Do I need to whitelist my domain in order to give it permissions to the file?

Works:

{
  "role": "reader",
  "type": "domain",
  "domain": "example.com"
}

Doesn't work:

{
  "role": "reader",
  "type": "domain",
  "domain": "mta.io"
}

Error:

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "invalid",
    "message": "The specified domain is invalid or not applicable for the given permission type.",
    "locationType": "other",
    "location": "permission.domain"
   }
  ],
  "code": 400,
  "message": "The specified domain is invalid or not applicable for the given permission type."
 }
}

I'm using the try it feature found on the API's site.

score 2 · Accepted Answer · answered Apr 19 '17 at 22:36

Figured it out, you can only use G Suite domains. It is a bummer but in order to share file permission exclusively with a domain you need to have a G Suite account and verify that you own that domain - the domain needs to be linked with your G Suite account.

https://developers.google.com/drive/v3/web/about-permissions#types_and_values

For example, a permission with a type of domain may have a domain of thecompany.com, indicating that the permission grants the given role to all users in the G Suite domain thecompany.com

score 0 · Answer 2 · edited May 23 '17 at 12:34

Based from this related thread, this can only be done between users in the same domain, and service accounts don't belong to any domain.

You're best option may be to create a Team Drive that the service account has access to, and perform a two stage process:

Use the service account to move the file into the team drive. Files.update with the addParents parameter set to the Team Drive ID.

Use the domain user to move the file out of the team drive. Files.update with the addParents parameter set to root (or some target folder's ID) and the removeParents parameter set to the Team Drive ID.

Here's another SO post which might also help: Google Drive SDK - change item sharing permissions

Google Drive API V3: Creating file permissions for a domain

2 Answers2