title: GMail API Super Admin access other users accounts via API?
body: <p>My institution is currently running Google Apps for Education since early 2009.  I’m responsible for creating, deleting, modifying, etc. , student email accounts.  I’ve converted all my existing C# applications from the GData to the new Admin SDK - life is good. </p>
  
  <p>Last week one of the departments sent out an email to roughly 800 students that contained an error. I was asked if it’s possible to create a quick application that is able to remove the email for the 800 students inbox.</p>
  
  <p>Using my “Super Admin” domain account I was able to create an application using the Gmail API to go into my inbox and select particular emails that matched a specific criteria; example: <code>from:xxxx@domain.edu AND is:unread AND subject:test</code>  I was able to return a collection of message id’s which then I can delete them from the inbox – GREAT!</p>
  
  <p>Since I was able to do this on my inbox I figured I’d conduct another test and plug in one of those 800 email addresses and get the same result.  Unfortunately I received this error message:</p>
  
  <blockquote>
    <p>Error: Google.Apis.Requests.RequestError
    Delegation denied for xxxxx@domain.edu [403]
    Errors [ Message[Delegation denied for  xxxxx@domain.edu] Location[ - ] Reason[forbidden] Domain[global] ]</p>
  </blockquote>
  
  <p>I did read something on account delegation but that would require a request being sent from my “Super Admin” account and the student accepting it.</p>
  
  <p>Could it be that the “Super Admin” of the domain doesn’t have these permissions on any inbox except for their own?  I’ve tried reading posts and Google’s documentation but I cannot seem to find an answer on this topic.</p>
  
  <p>The Gmail API is enabled in the developers console for this desktop application.</p>
  
  <p>The service account I’m using is authorized and in the C# application is using the correct Scopes: </p>
  
  <pre><code>Scopes = new[] { 
                          "https://mail.google.com",
                      GmailService.Scope.GmailCompose,
                      GmailService.Scope.GmailInsert,
                      GmailService.Scope.GmailLabels,
                      GmailService.Scope.GmailModify,
                      GmailService.Scope.GmailReadonly,
                      GmailService.Scope.MailGoogleCom,
                      "https://www.googleapis.com/auth/userinfo.email",
                      "https://www.googleapis.com/auth/userinfo.profile"},
  </code></pre>
  
  <p>My C# Code:</p>
  
  <pre><code>List&lt;Google.Apis.Gmail.v1.Data.Message&gt; result = new List&lt;Google.Apis.Gmail.v1.Data.Message&gt;();
  
  UsersResource.MessagesResource.ListRequest request = GoogleToken.GoogleService().Users.Messages.List("xxxxx@domain.edu");
  
  request.Q = " from:xxxx@domain.edu AND is:unread AND subject:test ";
  
              do
              {
                  try
                  {
                      ListMessagesResponse response = request.Execute();
                      result.AddRange(response.Messages);
                      request.PageToken = response.NextPageToken;
                  }
                  catch (Exception eX)
                  {
                      Debug.WriteLine("Error: " + eX.Message);
                  }
              }
              while (!String.IsNullOrEmpty(request.PageToken));
  
              Debug.WriteLine("Done");
              Debug.WriteLine(result);
          }
  </code></pre>