Google Business managers — list, invite and remove

The people who can manage a connected business on Google: its owners and managers, and the invitations still waiting to be accepted. They are served by Google’s Account Management API. Every call is one metered Google call and needs a package that includes the connector.

This API may need enabling and approval. If the Account Management API is not enabled or approved for the Google project MauKirim runs under, these calls answer 503 gmb_api_unavailable. That is an operator-side problem.

Roles. You can invite a person as MANAGER (the default) or SITE_MANAGER. OWNER is deliberately not offered: handing someone ownership of a client’s business is a decision for its current owner, in Google’s own interface, and an API key must not be able to make it. Anything but those two roles is 400 invalid_input.

GET /gmb/locations/{id}/admins

Who manages the business on Google.

Scope	read or gmb

curl https://app.maukirim.com/api/v1/gmb/locations/gml_8f3kq2x1ab/admins -H "Authorization: Bearer mk_live_…"

{ "ok": true, "admins": [ { "name": "locations/123/admins/a1", "admin": "owner@example.com", "role": "OWNER", "pendingInvitation": false } ] }

The entries are Google’s. name ends in the manager id (a1 here), which is what you pass to remove one; pendingInvitation is true until the person accepts.

---

POST /gmb/locations/{id}/admins

Invites a person to manage the business. 201 Created.

Scope	gmb
Header	Idempotency-Key (optional, recommended): 8–128 characters of letters, digits and _ . : -

Field	Required	Rule
email	yes	The person’s email address, up to 254 characters (stored lowercase)
role	no	MANAGER (default) or SITE_MANAGER

Google emails the person. The invitation is sent by Google to email, and the person gets access as soon as they accept it, so invite only an address the business owner has asked you to. Until then the manager shows with pendingInvitation: true in the list. Any other field is ignored.

curl -X POST https://app.maukirim.com/api/v1/gmb/locations/gml_8f3kq2x1ab/admins \
  -H "Authorization: Bearer mk_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: invite-gml_8f3kq2x1ab-staff-1" \
  -d '{ "email": "staff@example.com", "role": "SITE_MANAGER" }'

const response = await fetch(`https://app.maukirim.com/api/v1/gmb/locations/${id}/admins`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MAUKIRIM_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": `invite-${id}-staff-1`,
  },
  body: JSON.stringify({ email: "staff@example.com", role: "SITE_MANAGER" }),
})
const { admin } = await response.json()

$curl = curl_init("https://app.maukirim.com/api/v1/gmb/locations/$id/admins");
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('MAUKIRIM_KEY'),
        'Content-Type: application/json',
        "Idempotency-Key: invite-$id-staff-1",
    ],
    CURLOPT_POSTFIELDS => json_encode(['email' => 'staff@example.com', 'role' => 'SITE_MANAGER']),
    CURLOPT_RETURNTRANSFER => true,
]);
$admin = json_decode(curl_exec($curl), true)['admin'];

{
  "ok": true,
  "replayed": false,
  "admin": { "name": "locations/123/admins/a2", "admin": "staff@example.com", "role": "SITE_MANAGER", "pendingInvitation": true }
}

The same key with the same body is "replayed": true and sends no second invitation; the same key with a different body is 409 gmb_idempotency_conflict.

---

DELETE /gmb/locations/{id}/admins/{adminId}

Removes one manager, or cancels a pending invitation. The person loses access to the business. Returns { "ok": true }.

Scope	gmb
Path	adminId — the last part of the manager’s name from the list (letters, digits and _ . = -)

curl -X DELETE https://app.maukirim.com/api/v1/gmb/locations/gml_8f3kq2x1ab/admins/a2 -H "Authorization: Bearer mk_live_…"

Google decides whether you may remove a given person: for example the last owner cannot be removed, and the connected account may need to be an owner. Google’s refusal comes back as 403 gmb_forbidden or 400 invalid_input.

Errors

HTTP	Code	Condition
400	invalid_input	email missing or not an email address, a role other than MANAGER or SITE_MANAGER, a malformed key or id, or Google refused the request
401	api_key_invalid / api_key_revoked / api_key_expired
402	gmb_plan_required	The package does not include the connector
403	api_key_scope_denied	Inviting and removing need gmb; the list needs read or gmb
403	gmb_forbidden	Google says the connected account may not manage this business’s managers
404	gmb_location_not_found	Not your business, no such business, it left Google, or (remove) no such manager
409	gmb_reconnect_required / gmb_location_disabled / gmb_idempotency_conflict	See Errors
429	gmb_rate_limited	No budget now (Retry-After)
502	gmb_upstream_error	Google failed
503	gmb_api_unavailable	The Account Management API is not enabled or approved for the deployment’s Google project