agent hit Google Workspace API rate limit mid-scan, audit failed

TL;DR

Google's Admin SDK quotas are per-project, and the agent must honor quota errors with exponential backoff, drop concurrency to one, checkpoint per page, and split huge scans across runs.

agent hit Google Workspace API rate limit mid-scan, audit failed

Use this when

• An agent scanning Google Workspace hits quota errors mid-scan.
• The error mentions quota or rate, not scopes.
• The scan works on small domains but fails on large ones.

Not for this skill when

• The API returns 403 for missing scopes. Grant the scope.
• The failure is auth. Fix credentials.
• Quota is fine but results are empty. Check filters and the customer ID.

Steps

1. On quota errors, back off exponentially. Verify: the wait grows between attempts.
2. Reduce request concurrency to one. Verify: no parallel requests.
3. Checkpoint per page durably. Verify: progress survives interruption.
4. Resume from the checkpoint after the backoff. Verify: the scan continues.
5. For huge domains, split the scan across runs. Verify: each run covers its slice.

Variant phrasings

Google API quota exceeded

The message-first phrasing.

Admin SDK rate limit

The product-first search.

403 quota

The status-first phrasing.

Compatibility: Google Workspace Admin SDK, any agent runtime.

Why it happens

Google returns quota exhaustion as 403s, which look like permission errors but are not. The fix is pacing, not scopes, and agents that retry immediately make it worse.

Edge cases / pitfalls

• The project quota shared with other tools; the agent's fair share is smaller than the project quota.
• Retry-after hints in the error body; honor them when present.
• Splitting across runs needing durable checkpoints, not memory.
• Raising the project quota in the cloud console as the legitimate long-term fix.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstpCuDu6COjbzQkBW4zw7tQ