google api - GMail API Super Admin access other users accounts via API? -

my institution running google apps education since 2009. i’m responsible creating, deleting, modifying, etc. , student email accounts. i’ve converted existing c# applications gdata new admin sdk - life good.

last week 1 of departments sent out email 800 students contained error. asked if it’s possible create quick application able remove email 800 students inbox.

using “super admin” domain account able create application using gmail api go inbox , select particular emails matched specific criteria; example: from:xxxx@domain.edu , is:unread , subject:test able return collection of message id’s can delete them inbox – great!

since able on inbox figured i’d conduct test , plug in 1 of 800 email addresses , same result. unfortunately received error message:

error: google.apis.requests.requesterror delegation denied xxxxx@domain.edu [403] errors [ message[delegation denied xxxxx@domain.edu] location[ - ] reason[forbidden] domain[global] ]

i did read on account delegation require request being sent “super admin” account , student accepting it.

could “super admin” of domain doesn’t have these permissions on inbox except own? i’ve tried reading posts , google’s documentation cannot seem find answer on topic.

the gmail api enabled in developers console desktop application.

the service account i’m using authorized , in c# application using correct scopes:

scopes = new[] {                          "https://mail.google.com",                     gmailservice.scope.gmailcompose,                     gmailservice.scope.gmailinsert,                     gmailservice.scope.gmaillabels,                     gmailservice.scope.gmailmodify,                     gmailservice.scope.gmailreadonly,                     gmailservice.scope.mailgooglecom,                     "https://www.googleapis.com/auth/userinfo.email",                     "https://www.googleapis.com/auth/userinfo.profile"}, 

my c# code:

list<google.apis.gmail.v1.data.message> result = new list<google.apis.gmail.v1.data.message>();  usersresource.messagesresource.listrequest request = googletoken.googleservice().users.messages.list("xxxxx@domain.edu");  request.q = " from:xxxx@domain.edu , is:unread , subject:test ";                          {                 try                 {                     listmessagesresponse response = request.execute();                     result.addrange(response.messages);                     request.pagetoken = response.nextpagetoken;                 }                 catch (exception ex)                 {                     debug.writeline("error: " + ex.message);                 }             }             while (!string.isnullorempty(request.pagetoken));              debug.writeline("done");             debug.writeline(result);         } 

you cannot authenticate yourself , access other mailboxes, if admin in domain. however, domain admin, can whitelist app access users in domain. involves using service account domain wide delegation. need whitelist app in google apps cpanel , use different auth flow. see: https://developers.google.com/identity/protocols/oauth2serviceaccount#delegatingauthority

though really, email mistakes happen, have them reply followup correct misinformation. going , deleting email mailbox, if it's possible, seems bad idea "user trust" perspective (what happens if have bug , delete wrong mail!)--has tried reasoning said person idea? :-d users have seen email may worried/confused when disappears, etc.