Write access to Groups with Google Apps Provisioning API

Question

I am writing an app to interact with our Google Apps for Education domain using Zend Gdata framework and 3-legged OAuth.

So far I am only able to gain read-only access to Groups. It works fine and I have access to all information. However, write access does not work for me.

I end up with "Domain cannot use API"

$client = new Zend_Gdata_Gapps($httpClient, "domain.edu");

This works fine:

$client->retrieveAllGroups('https://apps-apis.google.com/a/feeds/group/2.0/domain.edu/');

This does not and results in "Domain cannot use API"

$client->createGroup('test-group', 'Test Group');

I found this page and it mentions something about Groups being Read-Only?

Groups Rosters HTTPS Read Only Scope:

https://apps-apis.google.com/a/feeds/group/#readonly

Is this true?

Edit: My Provisioning API is definitely enabled.

Answer 1

Drop the #readonly from the URL to get write-access to group feeds. What you picked up was meant for marketplace developers to access domain information when an admin installs the app.

A more generic scope for Apps APIs is documented here which allows access to all Google Apps Domain Information and management APIs:

Answer 2

It turns out that while i was testing someone else turned off Provisioning API because they did not like the scary warning message that told them about data not being synced between Google Apps and 3rd party management tools.