NEEDS DEV REVIEW Add missing actions and custom-schema limitation to Google Workspace docs

baton/google-workspace.mdx

@@ -2,7 +2,7 @@
 title: "Set up a Google Workspace connector"
 og:title: "Set up a Google Workspace connector"
 description: "C1 provides identity governance and just-in-time provisioning for Google Workspace. Integrate your Google Workspace instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 og:description: "C1 provides identity governance and just-in-time provisioning for Google Workspace. Integrate your Google Workspace instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 sidebarTitle: "Google Workspace"
 ---
 
@@ -23,24 +23,31 @@
 
 ### Connector actions
 
 Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.
 
 | Action name | Additional fields | Description |
 |-------------|-------------------|-------------|
 | update_user_status | `resource_id` (string, required)<br/>`is_suspended` (boolean, required) | Suspends or activates a user account |
 | disable_user | `user_id` (string, required) | Suspends a user account (idempotent) |
 | enable_user | `user_id` (string, required) | Unsuspends a user account (idempotent) |
 | change_user_primary_email | `resource_id` (string, required)<br/>`new_primary_email` (string, required) | Updates a user's primary email address |
 | transfer_user_drive_files | `resource_id` (string, required)<br/>`target_resource_id` (string, required)<br/>`privacy_levels` (string, optional) | Transfers Google Drive ownership from one user to another. Accepts `private` or `shared` for privacy_levels |
 | transfer_user_calendar | `resource_id` (string, required)<br/>`target_resource_id` (string, required)<br/>`release_resources` (boolean, optional) | Transfers Google Calendar data from one user to another |
 | change_user_org_unit | `user_id` (string, required)<br/>`org_unit_path` (string, required) | Moves a user to a different organizational unit |
 | offboarding_profile_update | `user_id` (string, required)<br/>`archive_account` (boolean, optional) | Comprehensive offboarding: removes from GAL, clears recovery details, deletes addresses/phones, optionally archives |
 | sign_out_user | `user_id` (string, required) | Signs user out of all sessions and resets sign-in cookies |
 | delete_all_oauth_tokens | `user_id` (string, required) | Revokes all third-party app authorizations |
 | delete_all_application_passwords | `user_id` (string, required) | Deletes all app-specific passwords |
 | create_group | `email` (string, required)<br/>`name` (string, required)<br/>`description` (string, optional) | Creates a new Google Workspace group |
 | modify_group_settings | `group_key` (string, required)<br/>`allow_external_members` (boolean, optional)<br/>`allow_web_posting` (boolean, optional)<br/>`who_can_post_message` (string, optional)<br/>`message_moderation_level` (string, optional) | Update settings for an existing Google Group |
 | update_user_manager | `user_id` (string, required)<br/> `manager_email` (string, required) | Updates the manager relation for a user in Google Workspace. Updates the 'manager' entry in the user's Relations field |
+| update_user_profile | `user_id` (resource ID, required)<br/>`given_name` (string, optional)<br/>`family_name` (string, optional)<br/>`recovery_email` (string, optional)<br/>`recovery_phone` (string, optional)<br/>`custom_schemas` (JSON string, optional) | Applies a partial update to a user's profile using patch semantics (only the provided fields change). Supports name fields, recovery details, and custom-schema attribute values. Custom-schema definitions must already exist in the Workspace tenant. At least one updatable field is required. |
+| update_user | `user_id` (resource ID, required)<br/>`user_profile` (JSON string, required) | Updates a user's profile from a `user_profile` JSON object (keys: `given_name`, `family_name`, `recovery_email`, `recovery_phone`, `custom_schemas`). Consumed by C1 push rules for automated profile sync. |
+| make_admin | `user_id` (resource ID, required)<br/>`status` (boolean, required) | Promotes (`status=true`) or demotes (`status=false`) a user to/from super administrator |
+
+<Warning>
+**Custom-schema limitation:** The `update_user_profile` and `update_user` actions can set custom-schema attribute values, but **deleting a field by sending a `null` value is not supported**. The Google Directory API `users.patch` endpoint silently ignores `null` values in the `customSchemas` payload — the field is not removed. To clear a custom-schema field, update it to an empty string or a sentinel value instead.
+</Warning>
 
 ## Gather Google Workspace credentials 
 
@@ -212,7 +219,7 @@
         Purpose: (Write) To manage role assignments (grant or revoke roles).
 
       - Scope:   https://www.googleapis.com/auth/admin.directory.user <br/>
-        Purpose: (Write) To provision/deprovision accounts.
+        Purpose: (Write) To provision/deprovision accounts, update user profiles and custom-schema values, and promote/demote super administrators.
 
       - Scope:   https://www.googleapis.com/auth/admin.reports.audit.readonly <br/>
         Purpose: To sync usage events and admin events (used in conjunction with continuous sync).
@@ -276,7 +283,7 @@
 <Step>
 Choose how to set up the new Google Workspace connector:
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -428,7 +435,7 @@
 
 <Steps>
 <Step>
 Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
 </Step>
 <Step>
 Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Google Workspace connector to. Google Workspace data should be found on the **Entitlements** and **Accounts** tabs.
@@ -441,7 +448,7 @@
 
 ### What's next?
 
 If Google Workspace is your company's identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in C1 for all of your SCIMed software. Before you move on, review the [Create applications](/product/admin/applications) page for important information about how to set up integrations with the SCIMed apps.
 
 ## Troubleshooting the Google Workspace integration