Google Workspace API - List group members via REST api

Question

I'm trying to use rest to list the members of a google workspace group via the rest api. Steps:

1. Created a service account
2. Delegated the scope https://www.googleapis.com/auth/admin.directory.group.readonly
3. Used the private key to generate an OAuth2 token
4. curl -v -H "Accept: application/json" -H "Authorization: Bearer $TOKEN" https://admin.googleapis.com/admin/directory/v1/groups\?userKey\=user@my-domain.com\&maxResults\=20

But I always get the same response:

{
  "error": {
    "code": 404,
    "message": "Domain not found.",
    "errors": [
      {
        "message": "Domain not found.",
        "domain": "global",
        "reason": "notFound"
      }
    ]
  }
}

What am I missing?

Answer 1

thanks to Not able to call directory APIs I figured it out. Needed to add the claim "sub" with the value of the email address of the user my service account token was bound to to the token exchange JWT and works!