gam7 7.11.0__py3-none-any.whl → 7.12.0__py3-none-any.whl

gam/__init__.py

@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """
 
 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.11.00'
+__version__ = '7.12.00'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'
 
 #pylint: disable=wrong-import-position
@@ -337,6 +337,7 @@ ENTITY_IS_A_GROUP_RC = 22
 ENTITY_IS_A_GROUP_ALIAS_RC = 23
 ENTITY_IS_AN_UNMANAGED_ACCOUNT_RC = 24
 ORGUNIT_NOT_EMPTY_RC = 25
+USER_SUSPENDED_RC = 26
 CHECK_USER_GROUPS_ERROR_RC = 29
 ORPHANS_COLLECTED_RC = 30
 # Warnings/Errors
@@ -634,7 +635,8 @@ def accessErrorMessage(cd, errMsg=None):
     cd = buildGAPIObject(API.DIRECTORY)
   try:
     callGAPI(cd.customers(), 'get',
-             throwReasons=[GAPI.BAD_REQUEST, GAPI.INVALID_INPUT, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+             throwReasons=[GAPI.BAD_REQUEST, GAPI.INVALID_INPUT, GAPI.RESOURCE_NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              customerKey=GC.Values[GC.CUSTOMER_ID], fields='id')
   except (GAPI.badRequest, GAPI.invalidInput):
     return formatKeyValueList('',
@@ -671,14 +673,16 @@ def accessErrorExitNonDirectory(api, errMsg):
                                      ''))
 
 def ClientAPIAccessDeniedExit(errMsg=None):
-  stderrErrorMsg(Msg.API_ACCESS_DENIED)
-  if errMsg:
+  if errMsg is None:
+    stderrErrorMsg(Msg.API_ACCESS_DENIED)
+    missingScopes = API.getClientScopesSet(GM.Globals[GM.CURRENT_CLIENT_API])-GM.Globals[GM.CURRENT_CLIENT_API_SCOPES]
+    if missingScopes:
+      writeStderr(Msg.API_CHECK_CLIENT_AUTHORIZATION.format(GM.Globals[GM.OAUTH2_CLIENT_ID],
+                                                            ','.join(sorted(missingScopes))))
+    systemErrorExit(API_ACCESS_DENIED_RC, None)
+  else:
     stderrErrorMsg(errMsg)
-  missingScopes = API.getClientScopesSet(GM.Globals[GM.CURRENT_CLIENT_API])-GM.Globals[GM.CURRENT_CLIENT_API_SCOPES]
-  if missingScopes:
-    writeStderr(Msg.API_CHECK_CLIENT_AUTHORIZATION.format(GM.Globals[GM.OAUTH2_CLIENT_ID],
-                                                          ','.join(sorted(missingScopes))))
-  systemErrorExit(API_ACCESS_DENIED_RC, None)
+    systemErrorExit(API_ACCESS_DENIED_RC, Msg.REAUTHENTICATION_IS_NEEDED)
 
 def SvcAcctAPIAccessDenied():
   _getSvcAcctData()
@@ -4458,6 +4462,8 @@ def handleOAuthTokenError(e, softErrors, displayError=False, i=0, count=0):
       errMsg.startswith('invalid_request: Invalid impersonation &quot;sub&quot; field')):
     if not GM.Globals[GM.CURRENT_SVCACCT_USER]:
       ClientAPIAccessDeniedExit()
+    # 403 Forbidden, API disabled, user not enabled
+    # 400 Bad Request, user not defined
     if softErrors:
       entityActionFailedWarning([Ent.USER, GM.Globals[GM.CURRENT_SVCACCT_USER], Ent.USER, None], errMsg, i, count)
       return None
@@ -4465,6 +4471,7 @@ def handleOAuthTokenError(e, softErrors, displayError=False, i=0, count=0):
   if errMsg in API.OAUTH2_UNAUTHORIZED_ERRORS:
     if not GM.Globals[GM.CURRENT_SVCACCT_USER]:
       ClientAPIAccessDeniedExit()
+    # 401 Unauthorized, API disabled, user enabled
     if softErrors:
       if displayError:
         apiOrScopes = API.getAPIName(GM.Globals[GM.CURRENT_SVCACCT_API]) if GM.Globals[GM.CURRENT_SVCACCT_API] else ','.join(sorted(GM.Globals[GM.CURRENT_SVCACCT_API_SCOPES]))
@@ -6515,7 +6522,8 @@ def getItemsToModify(entityType, entity, memberRoles=None, isSuspended=None, isA
           printGettingAllEntityItemsForWhom(Ent.TEACHER, removeCourseIdScope(courseId), entityType=Ent.COURSE)
           result = callGAPIpages(courseInfo['croom'].courses().teachers(), 'list', 'teachers',
                                  pageMessage=getPageMessageForWhom(),
-                                 throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.BAD_REQUEST, GAPI.SERVICE_NOT_AVAILABLE],
+                                 throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.SERVICE_NOT_AVAILABLE,
+                                               GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                  retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                                  courseId=courseId, fields='nextPageToken,teachers/profile/emailAddress',
                                  pageSize=GC.Values[GC.CLASSROOM_MAX_RESULTS])
@@ -6528,7 +6536,8 @@ def getItemsToModify(entityType, entity, memberRoles=None, isSuspended=None, isA
           printGettingAllEntityItemsForWhom(Ent.STUDENT, removeCourseIdScope(courseId), entityType=Ent.COURSE)
           result = callGAPIpages(courseInfo['croom'].courses().students(), 'list', 'students',
                                  pageMessage=getPageMessageForWhom(),
-                                 throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.BAD_REQUEST, GAPI.SERVICE_NOT_AVAILABLE],
+                                 throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.SERVICE_NOT_AVAILABLE,
+                                               GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                  retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                                  courseId=courseId, fields='nextPageToken,students/profile/emailAddress',
                                  pageSize=GC.Values[GC.CLASSROOM_MAX_RESULTS])
@@ -6544,8 +6553,8 @@ def getItemsToModify(entityType, entity, memberRoles=None, isSuspended=None, isA
         entityActionNotPerformedWarning([Ent.COURSE, removeCourseIdScope(courseId)], str(e))
         GM.Globals[GM.CLASSROOM_SERVICE_NOT_AVAILABLE] = True
         break
-      except (GAPI.forbidden, GAPI.badRequest):
-        ClientAPIAccessDeniedExit()
+      except (GAPI.forbidden, GAPI.permissionDenied, GAPI.badRequest) as e:
+        ClientAPIAccessDeniedExit(str(e))
   elif entityType == Cmd.ENTITY_CROS:
     buildGAPIObject(API.DIRECTORY)
     result = convertEntityToList(entity)
@@ -9023,7 +9032,7 @@ class CSVPrintFile():
     normalizeSortHeaders()
     if self.outputTranspose:
       newRows = []
-      newTitlesList = [i for i in range(len(self.rows)+1)]
+      newTitlesList = list(range(len(self.rows) + 1))
       for title in titlesList:
         i = 0
         newRow = {i: title}
@@ -15065,7 +15074,7 @@ def getRecipients():
 #	(embedimage <FileName> <String>)*
 #	[newuser <EmailAddress> firstname|givenname <String> lastname|familyname <string> password <Password>]
 #	(<SMTPDateHeader> <Time>)* (<SMTPHeader> <String>)* (header <String> <String>)*
-# gam <UserTypeEntity> sendemail recipient <RecipientEntity> [replyto <EmailAddress>]
+# gam <UserTypeEntity> sendemail recipient|to <RecipientEntity> [replyto <EmailAddress>]
 #	[cc <RecipientEntity>] [bcc <RecipientEntity>] [singlemessage]
 #	[subject <String>]
 #	[<MessageContent>]
@@ -15098,11 +15107,12 @@ def doSendEmail(users=None):
     if checkArgumentPresent({'recipient', 'recipients', 'to'}):
       msgFroms = [normalizeEmailAddressOrUID(entity) for entity in entityList]
       recipients = getRecipients()
-    else:
-      if checkArgumentPresent({'from'}):
-        msgFroms = [getString(Cmd.OB_EMAIL_ADDRESS)]
-        count = 1
+    elif checkArgumentPresent({'from'}):
       recipients = [normalizeEmailAddressOrUID(entity) for entity in entityList]
+      msgFroms = [getString(Cmd.OB_EMAIL_ADDRESS)]
+      count = 1
+    else:
+      missingArgumentExit('recipient|to|from')
   msgHeaders = {}
   ccRecipients = []
   bccRecipients = []
@@ -16010,8 +16020,9 @@ def doCreateDomainAlias():
   checkForExtraneousArguments()
   try:
     callGAPI(cd.domainAliases(), 'insert',
-             throwReasons=[GAPI.DOMAIN_NOT_FOUND, GAPI.DUPLICATE, GAPI.INVALID, GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
-                           GAPI.FORBIDDEN, GAPI.CONFLICT],
+             throwReasons=[GAPI.DOMAIN_NOT_FOUND, GAPI.DUPLICATE, GAPI.INVALID, GAPI.CONFLICT,
+                           GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              customer=GC.Values[GC.CUSTOMER_ID], body=body, fields='')
     entityActionPerformed([Ent.DOMAIN, body['parentDomainName'], Ent.DOMAIN_ALIAS, body['domainAliasName']])
   except GAPI.domainNotFound:
@@ -16020,8 +16031,10 @@ def doCreateDomainAlias():
     entityActionFailedWarning([Ent.DOMAIN, body['parentDomainName'], Ent.DOMAIN_ALIAS, body['domainAliasName']], Msg.DUPLICATE)
   except (GAPI.invalid, GAPI.conflict) as e:
     entityActionFailedWarning([Ent.DOMAIN, body['parentDomainName'], Ent.DOMAIN_ALIAS, body['domainAliasName']], str(e))
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden) as e:
+  except (GAPI.badRequest, GAPI.notFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam delete domainalias|aliasdomain <DomainAlias>
 def doDeleteDomainAlias():
@@ -16030,13 +16043,16 @@ def doDeleteDomainAlias():
   checkForExtraneousArguments()
   try:
     callGAPI(cd.domainAliases(), 'delete',
-             throwReasons=[GAPI.DOMAIN_ALIAS_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN],
+             throwReasons=[GAPI.DOMAIN_ALIAS_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              customer=GC.Values[GC.CUSTOMER_ID], domainAliasName=domainAliasName)
     entityActionPerformed([Ent.DOMAIN_ALIAS, domainAliasName])
   except GAPI.domainAliasNotFound:
     entityActionFailedWarning([Ent.DOMAIN_ALIAS, domainAliasName], Msg.DOES_NOT_EXIST)
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden) as e:
+  except (GAPI.badRequest, GAPI.notFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 DOMAIN_TIME_OBJECTS = {'creationTime'}
 DOMAIN_ALIAS_PRINT_ORDER = ['parentDomainName', 'creationTime', 'verified']
@@ -16064,14 +16080,17 @@ def doInfoDomainAlias():
   FJQC = FormatJSONQuoteChar(formatJSONOnly=True)
   try:
     result = callGAPI(cd.domainAliases(), 'get',
-                      throwReasons=[GAPI.DOMAIN_ALIAS_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN],
+                      throwReasons=[GAPI.DOMAIN_ALIAS_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                                    GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                       customer=GC.Values[GC.CUSTOMER_ID], domainAliasName=domainAliasName)
     aliasSkipObjects = DOMAIN_ALIAS_SKIP_OBJECTS
     _showDomainAlias(result, FJQC, aliasSkipObjects)
   except GAPI.domainAliasNotFound:
     entityActionFailedWarning([Ent.DOMAIN_ALIAS, domainAliasName], Msg.DOES_NOT_EXIST)
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden) as e:
+  except (GAPI.badRequest, GAPI.notFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 def _printDomain(domain, csvPF):
   row = {}
@@ -16107,7 +16126,8 @@ def doPrintShowDomainAliases():
       FJQC.GetFormatJSONQuoteChar(myarg, True)
   try:
     domainAliases = callGAPIitems(cd.domainAliases(), 'list', 'domainAliases',
-                                  throwReasons=[GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN],
+                                  throwReasons=[GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                                                GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                   customer=GC.Values[GC.CUSTOMER_ID])
     count = len(domainAliases)
     if showItemCountOnly:
@@ -16125,8 +16145,10 @@ def doPrintShowDomainAliases():
         csvPF.WriteRowNoFilter({'domainAliasName': domainAlias['domainAliasName'],
                                 'JSON': json.dumps(cleanJSON(domainAlias, timeObjects=DOMAIN_TIME_OBJECTS),
                                                    ensure_ascii=False, sort_keys=True)})
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden) as e:
+  except (GAPI.badRequest, GAPI.notFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   if csvPF:
     csvPF.writeCSVfile('Domain Aliases')
 
@@ -16137,15 +16159,19 @@ def doCreateDomain():
   checkForExtraneousArguments()
   try:
     callGAPI(cd.domains(), 'insert',
-             throwReasons=[GAPI.DUPLICATE, GAPI.DOMAIN_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.CONFLICT],
+             throwReasons=[GAPI.DUPLICATE, GAPI.CONFLICT,
+                           GAPI.DOMAIN_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              customer=GC.Values[GC.CUSTOMER_ID], body=body, fields='')
     entityActionPerformed([Ent.DOMAIN, body['domainName']])
   except GAPI.duplicate:
     entityDuplicateWarning([Ent.DOMAIN, body['domainName']])
   except GAPI.conflict as e:
     entityActionFailedWarning([Ent.DOMAIN, body['domainName']], str(e))
-  except (GAPI.domainNotFound, GAPI.badRequest, GAPI.notFound, GAPI.forbidden) as e:
+  except (GAPI.domainNotFound, GAPI.badRequest, GAPI.notFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam update domain <DomainName> primary
 def doUpdateDomain():
@@ -16162,13 +16188,17 @@ def doUpdateDomain():
     missingArgumentExit('primary')
   try:
     callGAPI(cd.customers(), 'update',
-             throwReasons=[GAPI.DOMAIN_NOT_VERIFIED_SECONDARY, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN, GAPI.INVALID_INPUT],
+             throwReasons=[GAPI.DOMAIN_NOT_VERIFIED_SECONDARY, GAPI.BAD_REQUEST,
+                           GAPI.RESOURCE_NOT_FOUND, GAPI.INVALID_INPUT,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              customerKey=GC.Values[GC.CUSTOMER_ID], body=body, fields='')
     entityActionPerformedMessage([Ent.DOMAIN, domainName], Msg.NOW_THE_PRIMARY_DOMAIN)
   except GAPI.domainNotVerifiedSecondary:
     entityActionFailedWarning([Ent.DOMAIN, domainName], Msg.DOMAIN_NOT_VERIFIED_SECONDARY)
-  except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden, GAPI.invalidInput) as e:
+  except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.invalidInput) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam delete domain <DomainName>
 def doDeleteDomain():
@@ -16177,11 +16207,14 @@ def doDeleteDomain():
   checkForExtraneousArguments()
   try:
     callGAPI(cd.domains(), 'delete',
-             throwReasons=[GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN],
+             throwReasons=[GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              customer=GC.Values[GC.CUSTOMER_ID], domainName=domainName)
     entityActionPerformed([Ent.DOMAIN, domainName])
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden) as e:
+  except (GAPI.badRequest, GAPI.notFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 CUSTOMER_LICENSE_MAP = {
   'accounts:num_users': 'Total Users',
@@ -16210,7 +16243,7 @@ def _showCustomerLicenseInfo(customerInfo, FJQC):
   while True:
     try:
       result = callGAPI(rep.customerUsageReports(), 'get',
-                        throwReasons=[GAPI.INVALID, GAPI.FORBIDDEN],
+                        throwReasons=[GAPI.INVALID, GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                         date=tryDate, customerId=customerInfo['id'],
                         fields='warnings,usageReports', parameters=parameters)
       usageReports = numUsersAvailable(result)
@@ -16228,8 +16261,8 @@ def _showCustomerLicenseInfo(customerInfo, FJQC):
       if not tryDate:
         return
       continue
-    except GAPI.forbidden:
-      return
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   if not FJQC.formatJSON:
     printKeyValueList([f'User counts as of {tryDate}:'])
     Ind.Increment()
@@ -16250,12 +16283,15 @@ def setTrueCustomerId(cd=None):
       cd = buildGAPIObject(API.DIRECTORY)
     try:
       customerInfo = callGAPI(cd.customers(), 'get',
-                              throwReasons=[GAPI.BAD_REQUEST, GAPI.INVALID_INPUT, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                              throwReasons=[GAPI.BAD_REQUEST, GAPI.INVALID_INPUT, GAPI.RESOURCE_NOT_FOUND,
+                                            GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                               customerKey=GC.MY_CUSTOMER,
                               fields='id')
       GC.Values[GC.CUSTOMER_ID] = customerInfo['id']
-    except (GAPI.badRequest, GAPI.invalidInput, GAPI.resourceNotFound, GAPI.forbidden):
+    except (GAPI.badRequest, GAPI.invalidInput, GAPI.resourceNotFound):
       pass
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 def _getCustomerId():
   customerId = GC.Values[GC.CUSTOMER_ID]
@@ -16289,7 +16325,8 @@ def doInfoCustomer(returnCustomerInfo=None, FJQC=None):
     FJQC = FormatJSONQuoteChar(formatJSONOnly=True)
   try:
     customerInfo = callGAPI(cd.customers(), 'get',
-                            throwReasons=[GAPI.BAD_REQUEST, GAPI.INVALID_INPUT, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                            throwReasons=[GAPI.BAD_REQUEST, GAPI.INVALID_INPUT, GAPI.RESOURCE_NOT_FOUND,
+                                          GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                             customerKey=customerId)
     if 'customerCreationTime' in customerInfo:
       customerInfo['customerCreationTime'] = formatLocalTime(customerInfo['customerCreationTime'])
@@ -16298,7 +16335,8 @@ def doInfoCustomer(returnCustomerInfo=None, FJQC=None):
     primaryDomain = {'domainName': UNKNOWN, 'verified': UNKNOWN}
     try:
       domains = callGAPIitems(cd.domains(), 'list', 'domains',
-                              throwReasons=[GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN],
+                              throwReasons=[GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                                            GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                               customer=customerInfo['id'], fields='domains(creationTime,domainName,isPrimary,verified)')
       for domain in domains:
         if domain.get('isPrimary'):
@@ -16334,8 +16372,8 @@ def doInfoCustomer(returnCustomerInfo=None, FJQC=None):
     _showCustomerLicenseInfo(customerInfo, FJQC)
   except (GAPI.badRequest, GAPI.invalidInput, GAPI.domainNotFound, GAPI.notFound, GAPI.resourceNotFound):
     accessErrorExit(cd)
-  except GAPI.forbidden as e:
-    entityActionFailedExit([Ent.CUSTOMER_ID, customerId], str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam update customer [primary <DomainName>] [adminsecondaryemail|alternateemail <EmailAddress>] [language <LanguageCode] [phone|phonenumber <String>]
 #	[contact|contactname <String>] [name|organizationname <String>]
@@ -16363,15 +16401,18 @@ def doUpdateCustomer():
   if body:
     try:
       callGAPI(cd.customers(), 'patch',
-               throwReasons=[GAPI.DOMAIN_NOT_VERIFIED_SECONDARY, GAPI.INVALID, GAPI.INVALID_INPUT, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+               throwReasons=[GAPI.DOMAIN_NOT_VERIFIED_SECONDARY, GAPI.INVALID, GAPI.INVALID_INPUT, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                             GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                customerKey=customerId, body=body, fields='')
       entityActionPerformed([Ent.CUSTOMER_ID, GC.Values[GC.CUSTOMER_ID]])
     except GAPI.domainNotVerifiedSecondary:
       entityActionFailedWarning([Ent.CUSTOMER_ID, GC.Values[GC.CUSTOMER_ID], Ent.DOMAIN, body['customerDomain']], Msg.DOMAIN_NOT_VERIFIED_SECONDARY)
     except (GAPI.invalid, GAPI.invalidInput) as e:
       entityActionFailedWarning([Ent.CUSTOMER_ID, GC.Values[GC.CUSTOMER_ID]], str(e))
-    except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+    except (GAPI.badRequest, GAPI.resourceNotFound):
       accessErrorExit(cd)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 # gam info instance [formatjson]
 def doInfoInstance():
@@ -16418,13 +16459,16 @@ def doInfoDomain():
   FJQC = FormatJSONQuoteChar(formatJSONOnly=True)
   try:
     result = callGAPI(cd.domains(), 'get',
-                      throwReasons=[GAPI.DOMAIN_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND, GAPI.FORBIDDEN],
+                      throwReasons=[GAPI.DOMAIN_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.NOT_FOUND,
+                                    GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                       customer=GC.Values[GC.CUSTOMER_ID], domainName=domainName)
     _showDomain(result, FJQC)
   except GAPI.domainNotFound:
     entityActionFailedWarning([Ent.DOMAIN, domainName], Msg.DOES_NOT_EXIST)
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden):
+  except (GAPI.badRequest, GAPI.notFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 DOMAIN_SORT_TITLES = ['domainName', 'parentDomainName', 'creationTime', 'type', 'verified']
 
@@ -16472,8 +16516,10 @@ def doPrintShowDomains():
         csvPF.WriteRowNoFilter({'domainName': domain['domainName'],
                                 'JSON': json.dumps(cleanJSON(domain, timeObjects=DOMAIN_TIME_OBJECTS),
                                                    ensure_ascii=False, sort_keys=True)})
-  except (GAPI.badRequest, GAPI.notFound, GAPI.forbidden, GAPI.domainNotFound) as e:
+  except (GAPI.badRequest, GAPI.notFound, GAPI.domainNotFound) as e:
     accessErrorExit(cd, str(e))
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   if csvPF:
     csvPF.writeCSVfile('Domains')
 
@@ -16483,10 +16529,13 @@ def _listPrivileges(cd):
   fields = f'items({",".join(PRINT_PRIVILEGES_FIELDS)})'
   try:
     return callGAPIitems(cd.privileges(), 'list', 'items',
-                         throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND, GAPI.FORBIDDEN],
+                         throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                       GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                          customer=GC.Values[GC.CUSTOMER_ID], fields=fields)
-  except (GAPI.badRequest, GAPI.customerNotFound, GAPI.forbidden):
+  except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam print privileges [todrive <ToDriveAttribute>*]
 # gam show privileges
@@ -16532,12 +16581,15 @@ def makeRoleIdNameMap():
   cd = buildGAPIObject(API.DIRECTORY)
   try:
     result = callGAPIpages(cd.roles(), 'list', 'items',
-                           throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND, GAPI.FORBIDDEN],
+                           throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                         GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                            customer=GC.Values[GC.CUSTOMER_ID],
                            fields='nextPageToken,items(roleId,roleName)',
                            maxResults=100)
-  except (GAPI.badRequest, GAPI.customerNotFound, GAPI.forbidden):
+  except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   for role in result:
     GM.Globals[GM.MAP_ROLE_ID_TO_NAME][role['roleId']] = role['roleName']
     GM.Globals[GM.MAP_ROLE_NAME_TO_ID][role['roleName'].lower()] = role['roleId']
@@ -16627,19 +16679,23 @@ def doCreateUpdateAdminRoles():
   try:
     if not updateCmd:
       result = callGAPI(cd.roles(), 'insert',
-                        throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND, GAPI.FORBIDDEN]+[GAPI.DUPLICATE],
+                        throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                      GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED]+[GAPI.DUPLICATE],
                         customer=GC.Values[GC.CUSTOMER_ID], body=body, fields='roleId,roleName')
     else:
       result = callGAPI(cd.roles(), 'patch',
-                        throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND, GAPI.FORBIDDEN]+[GAPI.NOT_FOUND, GAPI.FAILED_PRECONDITION, GAPI.CONFLICT],
+                        throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                      GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED]+[GAPI.NOT_FOUND, GAPI.FAILED_PRECONDITION, GAPI.CONFLICT],
                         customer=GC.Values[GC.CUSTOMER_ID], roleId=roleId, body=body, fields='roleId,roleName')
     entityActionPerformed([Ent.ADMIN_ROLE, f"{result['roleName']}({result['roleId']})"])
   except GAPI.duplicate as e:
     entityActionFailedWarning([Ent.ADMIN_ROLE, f"{body['roleName']}"], str(e))
-  except (GAPI.notFound, GAPI.forbidden, GAPI.failedPrecondition, GAPI.conflict) as e:
+  except (GAPI.notFound, GAPI.failedPrecondition, GAPI.conflict) as e:
     entityActionFailedWarning([Ent.ADMIN_ROLE, roleId], str(e))
   except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam delete adminrole <RoleItem>
 def doDeleteAdminRole():
@@ -16648,13 +16704,16 @@ def doDeleteAdminRole():
   checkForExtraneousArguments()
   try:
     callGAPI(cd.roles(), 'delete',
-             throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND, GAPI.FORBIDDEN]+[GAPI.NOT_FOUND, GAPI.FAILED_PRECONDITION],
+             throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED]+[GAPI.NOT_FOUND, GAPI.FAILED_PRECONDITION],
              customer=GC.Values[GC.CUSTOMER_ID], roleId=roleId)
     entityActionPerformed([Ent.ADMIN_ROLE, f"{role}({roleId})"])
-  except (GAPI.notFound, GAPI.forbidden, GAPI.failedPrecondition) as e:
+  except (GAPI.notFound, GAPI.failedPrecondition) as e:
     entityActionFailedWarning([Ent.ADMIN_ROLE, roleId], str(e))
   except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 PRINT_ADMIN_ROLES_FIELDS = ['roleId', 'roleName', 'roleDescription', 'isSuperAdminRole', 'isSystemRole']
 
@@ -16715,18 +16774,22 @@ def doInfoPrintShowAdminRoles():
       printGettingAllAccountEntities(Ent.ADMIN_ROLE)
       roles = callGAPIpages(cd.roles(), 'list', 'items',
                             pageMessage=getPageMessage(),
-                            throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND, GAPI.FORBIDDEN],
+                            throwReasons=[GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                          GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                             customer=GC.Values[GC.CUSTOMER_ID], fields=fields)
     else:
       fields = getFieldsFromFieldsList(fieldsList)
       roles = [callGAPI(cd.roles(), 'get',
-                        throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.FAILED_PRECONDITION,
-                                      GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND],
+                        throwReasons=[GAPI.NOT_FOUND, GAPI.FAILED_PRECONDITION,
+                                      GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                      GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                         customer=GC.Values[GC.CUSTOMER_ID], roleId=roleId, fields=fields)]
-  except (GAPI.notFound, GAPI.forbidden, GAPI.failedPrecondition) as e:
+  except (GAPI.notFound, GAPI.failedPrecondition) as e:
     entityActionFailedWarning([Ent.ADMIN_ROLE, roleId], str(e))
   except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   for role in roles:
     role.setdefault('isSuperAdminRole', False)
     role.setdefault('isSystemRole', False)
@@ -16785,8 +16848,9 @@ def doCreateAdmin():
   try:
     result = callGAPI(cd.roleAssignments(), 'insert',
                       throwReasons=[GAPI.INTERNAL_ERROR, GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
-                                    GAPI.FORBIDDEN, GAPI.CUSTOMER_EXCEEDED_ROLE_ASSIGNMENTS_LIMIT, GAPI.SERVICE_NOT_AVAILABLE,
-                                    GAPI.INVALID_ORGUNIT, GAPI.DUPLICATE, GAPI.CONDITION_NOT_MET],
+                                    GAPI.CUSTOMER_EXCEEDED_ROLE_ASSIGNMENTS_LIMIT, GAPI.SERVICE_NOT_AVAILABLE,
+                                    GAPI.INVALID_ORGUNIT, GAPI.DUPLICATE, GAPI.CONDITION_NOT_MET,
+                                    GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                       retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                       customer=GC.Values[GC.CUSTOMER_ID], body=body, fields='roleAssignmentId,assigneeType')
     assigneeType = result.get('assigneeType')
@@ -16800,14 +16864,16 @@ def doCreateAdmin():
                                  f'{Ent.Singular(entityType)} {user}, {Ent.Singular(Ent.ADMIN_ROLE)} {role}, {Ent.Singular(Ent.SCOPE)} {scope}')
   except GAPI.internalError:
     pass
-  except (GAPI.badRequest, GAPI.customerNotFound):
-    accessErrorExit(cd)
-  except (GAPI.forbidden, GAPI.customerExceededRoleAssignmentsLimit, GAPI.serviceNotAvailable, GAPI.conditionNotMet) as e:
+  except (GAPI.customerExceededRoleAssignmentsLimit, GAPI.serviceNotAvailable, GAPI.conditionNotMet) as e:
     entityActionFailedWarning([Ent.ADMINISTRATOR, user, Ent.ADMIN_ROLE, role], str(e))
   except GAPI.invalidOrgunit:
     entityActionFailedWarning([Ent.ADMINISTRATOR, user], Msg.INVALID_ORGUNIT)
   except GAPI.duplicate:
     entityActionFailedWarning([Ent.ADMINISTRATOR, user, Ent.ADMIN_ROLE, role], Msg.DUPLICATE)
+  except (GAPI.badRequest, GAPI.customerNotFound):
+    accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 # gam delete admin <RoleAssignmentId>
 def doDeleteAdmin():
@@ -16816,17 +16882,20 @@ def doDeleteAdmin():
   checkForExtraneousArguments()
   try:
     callGAPI(cd.roleAssignments(), 'delete',
-             throwReasons=[GAPI.NOT_FOUND, GAPI.OPERATION_NOT_SUPPORTED, GAPI.FORBIDDEN,
+             throwReasons=[GAPI.NOT_FOUND, GAPI.OPERATION_NOT_SUPPORTED,
                            GAPI.INVALID_INPUT, GAPI.SERVICE_NOT_AVAILABLE, GAPI.RESOURCE_NOT_FOUND,
-                           GAPI.FAILED_PRECONDITION, GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND],
+                           GAPI.FAILED_PRECONDITION, GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                           GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
              retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
              customer=GC.Values[GC.CUSTOMER_ID], roleAssignmentId=roleAssignmentId)
     entityActionPerformed([Ent.ADMIN_ROLE_ASSIGNMENT, roleAssignmentId])
-  except (GAPI.notFound, GAPI.operationNotSupported, GAPI.forbidden,
-          GAPI.invalidInput, GAPI.serviceNotAvailable, GAPI.resourceNotFound, GAPI.failedPrecondition) as e:
+  except (GAPI.notFound, GAPI.operationNotSupported, GAPI.invalidInput,
+          GAPI.serviceNotAvailable, GAPI.resourceNotFound, GAPI.failedPrecondition) as e:
     entityActionFailedWarning([Ent.ADMIN_ROLE_ASSIGNMENT, roleAssignmentId], str(e))
   except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 ASSIGNEE_EMAILTYPE_TOFIELD_MAP = {
   'user': 'assignedToUser',
@@ -16850,17 +16919,20 @@ def doPrintShowAdmins():
       if roleId not in rolePrivileges:
         try:
           rolePrivileges[roleId] = callGAPI(cd.roles(), 'get',
-                                            throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.FAILED_PRECONDITION,
-                                                          GAPI.SERVICE_NOT_AVAILABLE, GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND],
+                                            throwReasons=[GAPI.NOT_FOUND, GAPI.FAILED_PRECONDITION,
+                                                          GAPI.SERVICE_NOT_AVAILABLE, GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                                          GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                             retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                                             customer=GC.Values[GC.CUSTOMER_ID],
                                             roleId=roleId,
                                             fields='rolePrivileges')
-        except (GAPI.notFound, GAPI.forbidden, GAPI.failedPrecondition, GAPI.serviceNotAvailable) as e:
+        except (GAPI.notFound, GAPI.failedPrecondition, GAPI.serviceNotAvailable) as e:
           entityActionFailedExit([Ent.USER, userKey, Ent.ADMIN_ROLE, admin['roleId']], str(e))
           rolePrivileges[roleId] = None
         except (GAPI.badRequest, GAPI.customerNotFound):
           accessErrorExit(cd)
+        except (GAPI.forbidden, GAPI.permissionDenied) as e:
+          ClientAPIAccessDeniedExit(str(e))
       return rolePrivileges[roleId]
 
   def _setNamesFromIds(admin, privileges):
@@ -16870,9 +16942,7 @@ def doPrintShowAdmins():
     if assignedTo not in assignedToIdEmailMap:
       assigneeType = admin.get('assigneeType')
       assignedToField = ASSIGNEE_EMAILTYPE_TOFIELD_MAP.get(assigneeType, None)
-      assigneeEmail, assigneeType = convertUIDtoEmailAddressWithType(f'uid:{assignedTo}',
-                                                                     cd,
-                                                                     sal,
+      assigneeEmail, assigneeType = convertUIDtoEmailAddressWithType(f'uid:{assignedTo}', cd, sal,
                                                                      emailTypes=list(ASSIGNEE_EMAILTYPE_TOFIELD_MAP.keys()))
       if not assignedToField and assigneeType in ASSIGNEE_EMAILTYPE_TOFIELD_MAP:
         assignedToField = ASSIGNEE_EMAILTYPE_TOFIELD_MAP[assigneeType]
@@ -16929,16 +16999,19 @@ def doPrintShowAdmins():
                            pageMessage=getPageMessage(),
                            throwReasons=[GAPI.INVALID, GAPI.USER_NOT_FOUND,
                                          GAPI.FORBIDDEN, GAPI.SERVICE_NOT_AVAILABLE,
-                                         GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND],
+                                         GAPI.BAD_REQUEST, GAPI.CUSTOMER_NOT_FOUND,
+                                         GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                            retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                            customer=GC.Values[GC.CUSTOMER_ID], fields=fields, **kwargs)
   except (GAPI.invalid, GAPI.userNotFound):
     entityUnknownWarning(Ent.ADMINISTRATOR, userKey)
     return
-  except (GAPI.forbidden, GAPI.serviceNotAvailable) as e:
+  except (GAPI.serviceNotAvailable) as e:
     entityActionFailedExit([Ent.ADMINISTRATOR, userKey, Ent.ADMIN_ROLE, roleId], str(e))
   except (GAPI.badRequest, GAPI.customerNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   if not csvPF:
     count = len(admins)
     performActionNumItems(count, Ent.ADMIN_ROLE_ASSIGNMENT)
@@ -21429,7 +21502,9 @@ def queryPeopleOtherContacts(people, contactQuery, fields, entityType, user, i=0
     return entityList
   except GAPI.permissionDenied as e:
     ClientAPIAccessDeniedExit(str(e))
-  except (GAPI.serviceNotAvailable, GAPI.forbidden):
+  except GAPI.forbidden:
+    userPeopleServiceNotEnabledWarning(user, i, count)
+  except GAPI.serviceNotAvailable:
     entityUnknownWarning(entityType, user, i, count)
   return None
 
@@ -21549,10 +21624,8 @@ def createUserPeopleContact(users):
         csvPF.WriteRow(row)
     except GAPI.invalidArgument as e:
       entityActionFailedWarning([entityType, user, peopleEntityType, None], str(e), i, count)
-    except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+    except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
       ClientAPIAccessDeniedExit(str(e))
-    except (GAPI.serviceNotAvailable, GAPI.forbidden):
-      ClientAPIAccessDeniedExit()
   if csvPF:
     csvPF.writeCSVfile('People Contacts')
 
@@ -21714,10 +21787,8 @@ def _clearUpdatePeopleContacts(users, updateContacts):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], str(e), j, jcount)
       except (GAPI.notFound, GAPI.internalError):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], Msg.DOES_NOT_EXIST, j, jcount)
-      except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
     Ind.Decrement()
 
 # gam <UserTypeEntity> clear contacts <PeopleResourceNameEntity>|<PeopleUserContactSelection>
@@ -21864,10 +21935,8 @@ def dedupReplaceDomainUserPeopleContacts(users):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], str(e), j, jcount)
       except (GAPI.notFound, GAPI.internalError):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], Msg.DOES_NOT_EXIST, j, jcount)
-      except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
     Ind.Decrement()
 
 # gam <UserTypeEntity> delete contacts <PeopleResourceNameEntity>|<PeopleUserContactSelection>
@@ -21919,10 +21988,8 @@ def deleteUserPeopleContacts(users):
         entityActionPerformed([entityType, user, peopleEntityType, resourceName], j, jcount)
       except (GAPI.notFound, GAPI.internalError):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], Msg.DOES_NOT_EXIST, j, jcount)
-      except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
     Ind.Decrement()
 
 def _initPersonMetadataParameters():
@@ -22216,10 +22283,8 @@ def _infoPeople(users, entityType, source):
       except GAPI.invalidArgument as e:
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], str(e), j, jcount)
         continue
-      except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
       if showContactGroups and contactGroupIDs:
         addContactGroupNamesToContacts([result], contactGroupIDs, False)
       _showPerson(entityType, user, peopleEntityType, result, j, jcount, FJQC, parameters)
@@ -22396,10 +22461,8 @@ def copyUserPeopleOtherContacts(users):
       except (GAPI.notFound, GAPI.internalError):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], Msg.DOES_NOT_EXIST, j, jcount)
         continue
-      except GAPI.permissionDenied as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
     Ind.Decrement()
 
 # gam <UserTypeEntity> delete othercontacts
@@ -22512,10 +22575,8 @@ def processUserPeopleOtherContacts(users):
       except (GAPI.notFound, GAPI.internalError):
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName], Msg.DOES_NOT_EXIST, j, jcount)
         continue
-      except GAPI.permissionDenied as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
     Ind.Decrement()
 
 # gam <UserTypeEntity> print othercontacts [todrive <ToDriveAttribute>*] <OtherContactSelection>
@@ -22631,10 +22692,8 @@ def _printShowPeople(source):
                                pageSize=GC.Values[GC.PEOPLE_MAX_RESULTS],
                                sources=sources, mergeSources=mergeSources,
                                readMask=fields, fields='nextPageToken,people', **kwargs)
-  except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+  except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
     ClientAPIAccessDeniedExit(str(e))
-  except (GAPI.serviceNotAvailable, GAPI.forbidden):
-    ClientAPIAccessDeniedExit()
   if not countsOnly:
     _printPersonEntityList(peopleEntityType, entityList, Ent.DOMAIN, GC.Values[GC.DOMAIN], 0, 0, csvPF, FJQC, parameters, None)
   else:
@@ -22753,10 +22812,8 @@ def printShowUserPeopleProfiles(users):
     except GAPI.notFound:
       entityUnknownWarning(Ent.PEOPLE_PROFILE, user, i, count)
       continue
-    except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+    except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
       ClientAPIAccessDeniedExit(str(e))
-    except (GAPI.serviceNotAvailable, GAPI.forbidden):
-      ClientAPIAccessDeniedExit()
     if not csvPF:
       _showPerson(entityType, user, Ent.PEOPLE_PROFILE, result, i, count, FJQC, parameters)
     else:
@@ -22909,10 +22966,8 @@ def _processPeopleContactPhotos(users, function):
         entityDoesNotHaveItemWarning([entityType, user, peopleEntityType, resourceName, Ent.PHOTO, filename], j, jcount)
       except (GAPI.invalidArgument, OSError, IOError) as e:
         entityActionFailedWarning([entityType, user, peopleEntityType, resourceName, Ent.PHOTO, filename], str(e), j, jcount)
-      except (GAPI.permissionDenied, GAPI.failedPrecondition) as e:
+      except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied, GAPI.failedPrecondition) as e:
         ClientAPIAccessDeniedExit(str(e))
-      except (GAPI.serviceNotAvailable, GAPI.forbidden):
-        ClientAPIAccessDeniedExit()
         break
     Ind.Decrement()
 
@@ -23234,10 +23289,8 @@ def printShowUserPeopleContactGroups(users):
                                  throwReasons=GAPI.PEOPLE_ACCESS_THROW_REASONS,
                                  pageSize=GC.Values[GC.PEOPLE_MAX_RESULTS],
                                  groupFields=fields, fields='nextPageToken,contactGroups')
-    except GAPI.permissionDenied as e:
+    except (GAPI.serviceNotAvailable, GAPI.forbidden, GAPI.permissionDenied) as e:
       ClientAPIAccessDeniedExit(str(e))
-    except (GAPI.serviceNotAvailable, GAPI.forbidden):
-      ClientAPIAccessDeniedExit()
     _printPersonEntityList(Ent.PEOPLE_CONTACT_GROUP, entityList, entityType, user, i, count, csvPF, FJQC, parameters, None)
   if csvPF:
     csvPF.writeCSVfile('People Contact Groups')
@@ -31782,15 +31835,18 @@ def getMobileDeviceEntity():
     printGettingAllAccountEntities(Ent.MOBILE_DEVICE, query)
     devices = callGAPIpages(cd.mobiledevices(), 'list', 'mobiledevices',
                             pageMessage=getPageMessage(),
-                            throwReasons=[GAPI.INVALID_INPUT, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                            throwReasons=[GAPI.INVALID_INPUT, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                          GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                             customerId=GC.Values[GC.CUSTOMER_ID], query=query,
                             fields='nextPageToken,mobiledevices(resourceId,email)')
+    return ([{'resourceId': device['resourceId'], 'email': device.get('email', [])} for device in devices], cd, False)
   except GAPI.invalidInput:
     Cmd.Backup()
     usageErrorExit(Msg.INVALID_QUERY)
-  except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+  except (GAPI.badRequest, GAPI.resourceNotFound):
     accessErrorExit(cd)
-  return ([{'resourceId': device['resourceId'], 'email': device.get('email', [])} for device in devices], cd, False)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
 
 def _getUpdateDeleteMobileOptions(myarg, options):
   if myarg in {'matchusers', 'ifusers'}:
@@ -31843,14 +31899,17 @@ def doUpdateMobileDevices():
         callGAPI(cd.mobiledevices(), 'action',
                  bailOnInternalError=True,
                  throwReasons=[GAPI.INTERNAL_ERROR, GAPI.RESOURCE_ID_NOT_FOUND,
-                               GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                               GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                               GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                  customerId=GC.Values[GC.CUSTOMER_ID], resourceId=resourceId, body=body)
         printEntityKVList([Ent.MOBILE_DEVICE, resourceId, Ent.USER, deviceUser],
                           [Msg.ACTION_APPLIED, body['action']], i, count)
       except GAPI.internalError:
         entityActionFailedWarning([Ent.MOBILE_DEVICE, resourceId], Msg.DOES_NOT_EXIST, i, count)
-      except (GAPI.resourceIdNotFound, GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden) as e:
+      except (GAPI.resourceIdNotFound, GAPI.badRequest, GAPI.resourceNotFound) as e:
         entityActionFailedWarning([Ent.MOBILE_DEVICE, resourceId], str(e), i, count)
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
 
 # gam delete mobile|mobiles <MobileDeviceEntity>
 #	[doit] [matchusers <UserTypeEntity>]
@@ -31874,14 +31933,16 @@ def doDeleteMobileDevices():
       try:
         callGAPI(cd.mobiledevices(), 'delete',
                  bailOnInternalError=True,
-                 throwReasons=[GAPI.INTERNAL_ERROR, GAPI.RESOURCE_ID_NOT_FOUND, GAPI.BAD_REQUEST,
-                               GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                 throwReasons=[GAPI.INTERNAL_ERROR, GAPI.RESOURCE_ID_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                               GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                  customerId=GC.Values[GC.CUSTOMER_ID], resourceId=resourceId)
         entityActionPerformed([Ent.MOBILE_DEVICE, resourceId, Ent.USER, deviceUser], i, count)
       except GAPI.internalError:
         entityActionFailedWarning([Ent.MOBILE_DEVICE, resourceId], Msg.DOES_NOT_EXIST, i, count)
-      except (GAPI.resourceIdNotFound, GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden) as e:
+      except (GAPI.resourceIdNotFound, GAPI.badRequest, GAPI.resourceNotFound) as e:
         entityActionFailedWarning([Ent.MOBILE_DEVICE, resourceId], str(e), i, count)
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
 
 MOBILE_FIELDS_CHOICE_MAP = {
   'adbstatus': 'adbStatus',
@@ -31963,8 +32024,8 @@ def doInfoMobileDevices():
     try:
       mobile = callGAPI(cd.mobiledevices(), 'get',
                         bailOnInternalError=True,
-                        throwReasons=[GAPI.INTERNAL_ERROR, GAPI.RESOURCE_ID_NOT_FOUND,
-                                      GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                        throwReasons=[GAPI.INTERNAL_ERROR, GAPI.RESOURCE_ID_NOT_FOUND, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                      GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                         customerId=GC.Values[GC.CUSTOMER_ID], resourceId=resourceId, projection=parameters['projection'], fields=fields)
       if FJQC.formatJSON:
         printLine(json.dumps(cleanJSON(mobile, timeObjects=MOBILE_TIME_OBJECTS), ensure_ascii=False, sort_keys=True))
@@ -31981,8 +32042,10 @@ def doInfoMobileDevices():
         Ind.Decrement()
     except GAPI.internalError:
       entityActionFailedWarning([Ent.MOBILE_DEVICE, resourceId], Msg.DOES_NOT_EXIST, i, count)
-    except (GAPI.resourceIdNotFound, GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden) as e:
+    except (GAPI.resourceIdNotFound, GAPI.badRequest, GAPI.resourceNotFound) as e:
       entityActionFailedWarning([Ent.MOBILE_DEVICE, resourceId], str(e), i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 MOBILE_ORDERBY_CHOICE_MAP = {
   'deviceid': 'deviceId',
@@ -32111,7 +32174,8 @@ def doPrintMobileDevices():
     try:
       feed = yieldGAPIpages(cd.mobiledevices(), 'list', 'mobiledevices',
                             pageMessage=pageMessage,
-                            throwReasons=[GAPI.INVALID_INPUT, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                            throwReasons=[GAPI.INVALID_INPUT, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                          GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                             customerId=GC.Values[GC.CUSTOMER_ID], query=query, projection=parameters['projection'],
                             orderBy=orderBy, sortOrder=sortOrder, fields=fields, maxResults=GC.Values[GC.MOBILE_MAX_RESULTS])
       for mobiles in feed:
@@ -32125,8 +32189,10 @@ def doPrintMobileDevices():
     except GAPI.invalidInput:
       entityActionFailedWarning([Ent.MOBILE_DEVICE, None], invalidQuery(query))
       return
-    except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+    except (GAPI.badRequest, GAPI.resourceNotFound):
       accessErrorExit(cd)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   if showItemCountOnly:
     writeStdout(f'{itemCount}\n')
     return
@@ -36452,8 +36518,8 @@ def doPrintShowCIPolicies():
                                                  sort_keys=True)})
 
   _checkPoliciesWithDASA()
-  groups_ci = buildGAPIObject(API.CLOUDIDENTITY_GROUPS)
   ci = buildGAPIObject(API.CLOUDIDENTITY_POLICY)
+  groups_ci = buildGAPIObject(API.CLOUDIDENTITY_GROUPS)
   cd = buildGAPIObject(API.DIRECTORY)
   csvPF = CSVPrintFile(['name']) if Act.csvFormat() else None
   FJQC = FormatJSONQuoteChar(csvPF)
@@ -38464,10 +38530,13 @@ def doPrintShowResourceCalendars():
   try:
     resources = callGAPIpages(cd.resources().calendars(), 'list', 'items',
                               pageMessage=getPageMessage(showFirstLastItems=True), messageAttribute='resourceName',
-                              throwReasons=[GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN, GAPI.INVALID_INPUT],
+                              throwReasons=[GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN,
+                                            GAPI.PERMISSION_DENIED, GAPI.INVALID_INPUT],
                               query=query, customer=GC.Values[GC.CUSTOMER_ID], fields=fields)
-  except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+  except (GAPI.badRequest, GAPI.resourceNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   except GAPI.invalidInput as e:
     entityActionFailedWarning([Ent.RESOURCE_CALENDAR, ''], str(e))
     return
@@ -40706,7 +40775,8 @@ def doCreateUpdateUserSchemas():
     try:
       if updateCmd:
         oldBody = callGAPI(cd.schemas(), 'get',
-                           throwReasons=[GAPI.INVALID, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                           throwReasons=[GAPI.INVALID, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                         GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                            customerId=GC.Values[GC.CUSTOMER_ID], schemaKey=schemaName, fields='schemaName,displayName,fields')
         for field in oldBody['fields']:
           field.pop('etag', None)
@@ -40745,15 +40815,18 @@ def doCreateUpdateUserSchemas():
         addBody['schemaName'] = schemaName.replace(' ', '_')
         addBody['displayName'] = schemaDisplayName if schemaDisplayName else schemaName
         result = callGAPI(cd.schemas(), 'insert',
-                          throwReasons=[GAPI.DUPLICATE, GAPI.CONDITION_NOT_MET, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                          throwReasons=[GAPI.DUPLICATE, GAPI.CONDITION_NOT_MET, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                        GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                           customerId=GC.Values[GC.CUSTOMER_ID], body=addBody, fields='schemaName')
         entityActionPerformed([Ent.USER_SCHEMA, result['schemaName']], i, count)
     except GAPI.duplicate:
       entityDuplicateWarning([Ent.USER_SCHEMA, schemaName], i, count)
-    except (GAPI.conditionNotMet, GAPI.fieldInUse, GAPI.forbidden) as e:
+    except (GAPI.conditionNotMet, GAPI.fieldInUse) as e:
       entityActionFailedWarning([Ent.USER_SCHEMA, schemaName], str(e), i, count)
     except (GAPI.badRequest, GAPI.resourceNotFound):
       checkEntityAFDNEorAccessErrorExit(cd, Ent.USER_SCHEMA, schemaName, i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 # gam delete schema|schemas <SchemaEntity>
 def doDeleteUserSchemas():
@@ -40766,13 +40839,16 @@ def doDeleteUserSchemas():
     i += 1
     try:
       callGAPI(cd.schemas(), 'delete',
-               throwReasons=[GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN, GAPI.FIELD_IN_USE],
+               throwReasons=[GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FIELD_IN_USE,
+                             GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                customerId=GC.Values[GC.CUSTOMER_ID], schemaKey=schemaKey)
       entityActionPerformed([Ent.USER_SCHEMA, schemaKey], i, count)
     except GAPI.fieldInUse as e:
       entityActionFailedWarning([Ent.USER_SCHEMA, schemaKey], str(e), i, count)
-    except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+    except (GAPI.badRequest, GAPI.resourceNotFound):
       checkEntityAFDNEorAccessErrorExit(cd, Ent.USER_SCHEMA, schemaKey, i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 # gam info schema|schemas <SchemaEntity>
 def doInfoUserSchemas():
@@ -40785,11 +40861,14 @@ def doInfoUserSchemas():
     i += 1
     try:
       schema = callGAPI(cd.schemas(), 'get',
-                        throwReasons=[GAPI.INVALID, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                        throwReasons=[GAPI.INVALID, GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                      GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                         customerId=GC.Values[GC.CUSTOMER_ID], schemaKey=schemaKey)
       _showSchema(schema, i, count)
-    except (GAPI.invalid, GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+    except (GAPI.invalid, GAPI.badRequest, GAPI.resourceNotFound):
       checkEntityAFDNEorAccessErrorExit(cd, Ent.USER_SCHEMA, schemaKey, i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 SCHEMAS_SORT_TITLES = ['schemaId', 'schemaName', 'displayName']
 SCHEMAS_INDEXED_TITLES = ['fields']
@@ -40802,7 +40881,8 @@ def doPrintShowUserSchemas():
   getTodriveOnly(csvPF)
   try:
     result = callGAPI(cd.schemas(), 'list',
-                      throwReasons=[GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND, GAPI.FORBIDDEN],
+                      throwReasons=[GAPI.BAD_REQUEST, GAPI.RESOURCE_NOT_FOUND,
+                                    GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                       customerId=GC.Values[GC.CUSTOMER_ID])
     jcount = len(result.get('schemas', [])) if (result) else 0
     if not csvPF:
@@ -40820,8 +40900,10 @@ def doPrintShowUserSchemas():
       else:
         for schema in result['schemas']:
           csvPF.WriteRowTitles(flattenJSON(schema))
-  except (GAPI.badRequest, GAPI.resourceNotFound, GAPI.forbidden):
+  except (GAPI.badRequest, GAPI.resourceNotFound):
     accessErrorExit(cd)
+  except (GAPI.forbidden, GAPI.permissionDenied) as e:
+    ClientAPIAccessDeniedExit(str(e))
   if csvPF:
     csvPF.writeCSVfile('User Schemas')
 
@@ -41082,11 +41164,14 @@ def convertExportNameToID(v, nameOrId, matterId, matterNameId):
   if cg:
     try:
       export = callGAPI(v.matters().exports(), 'get',
-                        throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN, GAPI.INVALID_ARGUMENT],
+                        throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN,
+                                      GAPI.INVALID_ARGUMENT, GAPI.FAILED_PRECONDITION],
                         matterId=matterId, exportId=cg.group(1))
       return (export['id'], export['name'], formatVaultNameId(export['id'], export['name']))
     except (GAPI.notFound, GAPI.badRequest):
       entityDoesNotHaveItemExit([Ent.VAULT_MATTER, matterNameId, Ent.VAULT_EXPORT, nameOrId])
+    except (GAPI.failedPrecondition) as e:
+      entityActionFailedExit([Ent.VAULT_MATTER, matterNameId, Ent.VAULT_EXPORT, nameOrId], str(e))
     except (GAPI.forbidden, GAPI.invalidArgument) as e:
       ClientAPIAccessDeniedExit(str(e))
   nameOrIdlower = nameOrId.lower()
@@ -41582,10 +41667,11 @@ def doInfoVaultExport():
   fields = getFieldsFromFieldsList(fieldsList)
   try:
     export = callGAPI(v.matters().exports(), 'get',
-                      throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN, GAPI.INVALID_ARGUMENT],
+                      throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN,
+                                    GAPI.INVALID_ARGUMENT, GAPI.FAILED_PRECONDITION],
                       matterId=matterId, exportId=exportId, fields=fields)
     _showVaultExport(matterNameId, export, cd, FJQC)
-  except (GAPI.notFound, GAPI.badRequest, GAPI.forbidden, GAPI.invalidArgument) as e:
+  except (GAPI.notFound, GAPI.badRequest, GAPI.forbidden, GAPI.invalidArgument, GAPI.failedPrecondition) as e:
     entityActionFailedWarning([Ent.VAULT_MATTER, matterNameId, Ent.VAULT_EXPORT, exportNameId], str(e))
 
 VAULT_EXPORT_STATUS_MAP = {'completed': 'COMPLETED', 'failed': 'FAILED', 'inprogress': 'IN_PROGRESS'}
@@ -41778,9 +41864,10 @@ def doCopyVaultExport():
   while True:
     try:
       export = callGAPI(v.matters().exports(), 'get',
-                        throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN, GAPI.INVALID_ARGUMENT],
+                        throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN,
+                                      GAPI.INVALID_ARGUMENT, GAPI.FAILED_PRECONDITION],
                         matterId=matterId, exportId=exportId)
-    except (GAPI.notFound, GAPI.badRequest, GAPI.forbidden, GAPI.invalidArgument) as e:
+    except (GAPI.notFound, GAPI.badRequest, GAPI.forbidden, GAPI.invalidArgument, GAPI.failedPrecondition) as e:
       entityActionFailedWarning([Ent.VAULT_MATTER, matterNameId, Ent.VAULT_EXPORT, exportNameId], str(e))
       return
     if export['status'] == 'COMPLETED':
@@ -41878,9 +41965,10 @@ def doDownloadVaultExport():
   while True:
     try:
       export = callGAPI(v.matters().exports(), 'get',
-                        throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN, GAPI.INVALID_ARGUMENT],
+                        throwReasons=[GAPI.NOT_FOUND, GAPI.BAD_REQUEST, GAPI.FORBIDDEN,
+                                      GAPI.INVALID_ARGUMENT, GAPI.FAILED_PRECONDITION],
                         matterId=matterId, exportId=exportId)
-    except (GAPI.notFound, GAPI.badRequest, GAPI.forbidden, GAPI.invalidArgument) as e:
+    except (GAPI.notFound, GAPI.badRequest, GAPI.forbidden, GAPI.invalidArgument, GAPI.failedPrecondition) as e:
       entityActionFailedWarning([Ent.VAULT_MATTER, matterNameId, Ent.VAULT_EXPORT, exportNameId], str(e))
       return
     if export['status'] == 'COMPLETED':
@@ -44306,6 +44394,28 @@ def doUndeleteUsers():
 def doUndeleteUser():
   undeleteUsers(getStringReturnInList(Cmd.OB_USER_ITEM))
 
+# gam check suspended <UserItem>
+def doCheckUserSuspended():
+  cd = buildGAPIObject(API.DIRECTORY)
+  user = getEmailAddress()
+  checkForExtraneousArguments()
+  try:
+    result = callGAPI(cd.users(), 'get',
+                      throwReasons=GAPI.USER_GET_THROW_REASONS,
+                      userKey=user, fields='suspended,suspensionReason', projection='basic')
+  except (GAPI.userNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden):
+    entityDoesNotExistExit(Ent.USER, user)
+  except (GAPI.badRequest, GAPI.invalidCustomerId, GAPI.loginRequired):
+    accessErrorExit(cd)
+  kvList = [Ent.Singular(Ent.USER), user]
+  up = 'suspended'
+  kvList.extend([UProp.PROPERTIES[up][UProp.TITLE], result[up]])
+  if result[up]:
+    up = 'suspensionReason'
+    kvList.extend([UProp.PROPERTIES[up][UProp.TITLE], result[up]])
+    setSysExitRC(USER_SUSPENDED_RC)
+  printKeyValueList(kvList)
+
 # gam <UserTypeEntity> suspend users [noactionifalias]
 # gam <UserTypeEntity> unsuspend users [noactionifalias]
 def suspendUnsuspendUsers(entityList):
@@ -44359,13 +44469,13 @@ def signoutTurnoff2SVUsers(entityList):
       callGAPI(service, function,
                throwReasons=[GAPI.NOT_FOUND, GAPI.USER_NOT_FOUND, GAPI.INVALID, GAPI.INVALID_INPUT,
                              GAPI.DOMAIN_NOT_FOUND, GAPI.DOMAIN_CANNOT_USE_APIS,
-                             GAPI.FORBIDDEN, GAPI.AUTH_ERROR],
+                             GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED, GAPI.AUTH_ERROR],
                userKey=user)
       entityActionPerformed([Ent.USER, user], i, count)
     except (GAPI.notFound, GAPI.userNotFound):
       entityUnknownWarning(Ent.USER, user, i, count)
     except (GAPI.invalid, GAPI.invalidInput, GAPI.domainNotFound, GAPI.domainCannotUseApis,
-            GAPI.forbidden, GAPI.authError) as e:
+            GAPI.forbidden, GAPI.permissionDenied, GAPI.authError) as e:
       entityActionFailedWarning([Ent.USER, user], str(e), i, count)
 
 # gam <UserTypeEntity> waitformailbox [retries <Number>]
@@ -47229,10 +47339,7 @@ class CourseAttributes():
           newTopicsByName[topicName] = result['topicId']
           entityModifierItemValueListActionPerformed([Ent.COURSE, newCourseId, Ent.COURSE_TOPIC, topicName], Act.MODIFIER_FROM,
                                                      [Ent.COURSE, self.courseId], j, jcount)
-        except GAPI.notFound as e:
-          entityActionFailedWarning([Ent.COURSE, newCourseId], str(e), i, count)
-          return
-        except (GAPI.failedPrecondition, GAPI.invalidArgument, GAPI.forbidden, GAPI.serviceNotAvailable) as e:
+        except (GAPI.notFound, GAPI.failedPrecondition, GAPI.invalidArgument, GAPI.forbidden, GAPI.serviceNotAvailable) as e:
           entityModifierItemValueListActionFailedWarning([Ent.COURSE, newCourseId], Act.MODIFIER_FROM,
                                                          [Ent.COURSE, self.courseId, Ent.COURSE_TOPIC, topicName], str(e), j, jcount)
     if self.courseAnnouncements:
@@ -47255,10 +47362,7 @@ class CourseAttributes():
                             courseId=newCourseId, body=body, fields='id')
           entityModifierItemValueListActionPerformed([Ent.COURSE, newCourseId, Ent.COURSE_ANNOUNCEMENT_ID, result['id']], Act.MODIFIER_FROM,
                                                      [Ent.COURSE, self.courseId, Ent.COURSE_ANNOUNCEMENT, courseAnnouncementId], j, jcount)
-        except GAPI.notFound as e:
-          entityActionFailedWarning([Ent.COURSE, newCourseId], str(e), i, count)
-          return
-        except (GAPI.badRequest, GAPI.failedPrecondition, GAPI.backendError, GAPI.internalError,
+        except (GAPI.notFound, GAPI.badRequest, GAPI.failedPrecondition, GAPI.backendError, GAPI.internalError,
                 GAPI.permissionDenied, GAPI.forbidden, GAPI.serviceNotAvailable) as e:
           entityModifierItemValueListActionFailedWarning([Ent.COURSE, newCourseId], Act.MODIFIER_FROM,
                                                          [Ent.COURSE, self.courseId, Ent.COURSE_ANNOUNCEMENT, courseAnnouncementId], str(e), j, jcount)
@@ -47290,10 +47394,7 @@ class CourseAttributes():
                             courseId=newCourseId, body=body, fields='id')
           entityModifierItemValueListActionPerformed([Ent.COURSE, newCourseId, Ent.COURSE_MATERIAL_ID, result['id']], Act.MODIFIER_FROM,
                                                      [Ent.COURSE, self.courseId, Ent.COURSE_MATERIAL, courseMaterialId], j, jcount)
-        except GAPI.notFound as e:
-          entityActionFailedWarning([Ent.COURSE, newCourseId], str(e), i, count)
-          return
-        except (GAPI.badRequest, GAPI.failedPrecondition, GAPI.backendError, GAPI.internalError,
+        except (GAPI.notFound, GAPI.badRequest, GAPI.failedPrecondition, GAPI.backendError, GAPI.internalError,
                 GAPI.permissionDenied, GAPI.forbidden, GAPI.serviceNotAvailable) as e:
           entityModifierItemValueListActionFailedWarning([Ent.COURSE, newCourseId], Act.MODIFIER_FROM,
                                                          [Ent.COURSE, self.courseId, Ent.COURSE_MATERIAL, courseMaterialId], str(e), j, jcount)
@@ -47330,10 +47431,7 @@ class CourseAttributes():
                             courseId=newCourseId, body=body, fields='id')
           entityModifierItemValueListActionPerformed([Ent.COURSE, newCourseId, Ent.COURSE_WORK_ID, result['id']], Act.MODIFIER_FROM,
                                                      [Ent.COURSE, self.courseId, Ent.COURSE_WORK, courseWorkId], j, jcount)
-        except GAPI.notFound as e:
-          entityActionFailedWarning([Ent.COURSE, newCourseId], str(e), i, count)
-          return
-        except (GAPI.badRequest, GAPI.failedPrecondition, GAPI.backendError, GAPI.internalError, GAPI.invalidArgument,
+        except (GAPI.notFound, GAPI.badRequest, GAPI.failedPrecondition, GAPI.backendError, GAPI.internalError, GAPI.invalidArgument,
                 GAPI.permissionDenied, GAPI.forbidden, GAPI.serviceNotAvailable) as e:
           entityModifierItemValueListActionFailedWarning([Ent.COURSE, newCourseId], Act.MODIFIER_FROM,
                                                          [Ent.COURSE, self.courseId, Ent.COURSE_WORK, courseWorkId], str(e), j, jcount)
@@ -47688,7 +47786,8 @@ def _getCoursesOwnerInfo(croom, courseIds, useOwnerAccess, addCIIdScope=True):
     if courseId not in coursesInfo:
       try:
         course = callGAPI(croom.courses(), 'get',
-                          throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED, GAPI.SERVICE_NOT_AVAILABLE],
+                          throwReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE,
+                                        GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                           retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                           id=courseId, fields='name,ownerId')
         if useOwnerAccess:
@@ -47699,10 +47798,10 @@ def _getCoursesOwnerInfo(croom, courseIds, useOwnerAccess, addCIIdScope=True):
           coursesInfo[ciCourseId] = {'name': course['name'], 'croom': ocroom}
       except GAPI.notFound:
         entityDoesNotExistWarning(Ent.COURSE, courseId)
-      except (GAPI.permissionDenied, GAPI.serviceNotAvailable) as e:
+      except GAPI.serviceNotAvailable as e:
         entityActionFailedWarning([Ent.COURSE, courseId], str(e))
-      except GAPI.forbidden:
-        ClientAPIAccessDeniedExit()
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
   return 0, len(coursesInfo), coursesInfo
 
 def _getCourseAliasesMembers(croom, ocroom, courseId, courseShowProperties, teachersFields, studentsFields, showGettings=False, i=0, count=0):
@@ -47718,13 +47817,14 @@ def _getCourseAliasesMembers(croom, ocroom, courseId, courseShowProperties, teac
     try:
       aliases = callGAPIpages(croom.courses().aliases(), 'list', 'aliases',
                               pageMessage=pageMessage,
-                              throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.SERVICE_NOT_AVAILABLE, GAPI.NOT_IMPLEMENTED],
+                              throwReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE, GAPI.NOT_IMPLEMENTED,
+                                            GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                               retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                               courseId=courseId, pageSize=GC.Values[GC.CLASSROOM_MAX_RESULTS])
     except (GAPI.notFound, GAPI.serviceNotAvailable, GAPI.notImplemented):
       pass
-    except GAPI.forbidden:
-      ClientAPIAccessDeniedExit()
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   if courseShowProperties['members'] != 'none':
     if courseShowProperties['members'] != 'students':
       if showGettings:
@@ -47733,13 +47833,14 @@ def _getCourseAliasesMembers(croom, ocroom, courseId, courseShowProperties, teac
       try:
         teachers = callGAPIpages(ocroom.courses().teachers(), 'list', 'teachers',
                                  pageMessage=pageMessage,
-                                 throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.SERVICE_NOT_AVAILABLE],
+                                 throwReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE,
+                                               GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                  retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                                  courseId=courseId, fields=teachersFields, pageSize=GC.Values[GC.CLASSROOM_MAX_RESULTS])
       except (GAPI.notFound, GAPI.serviceNotAvailable):
         pass
-      except GAPI.forbidden:
-        ClientAPIAccessDeniedExit()
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
     if courseShowProperties['members'] != 'teachers':
       if showGettings:
         printGettingEntityItemForWhom(Ent.STUDENT, formatKeyValueList('', [Ent.Singular(Ent.COURSE), courseId], currentCount(i, count)))
@@ -47747,13 +47848,14 @@ def _getCourseAliasesMembers(croom, ocroom, courseId, courseShowProperties, teac
       try:
         students = callGAPIpages(ocroom.courses().students(), 'list', 'students',
                                  pageMessage=pageMessage,
-                                 throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.SERVICE_NOT_AVAILABLE],
+                                 throwReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE,
+                                               GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                  retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                                  courseId=courseId, fields=studentsFields, pageSize=GC.Values[GC.CLASSROOM_MAX_RESULTS])
       except (GAPI.notFound, GAPI.serviceNotAvailable):
         pass
-      except GAPI.forbidden:
-        ClientAPIAccessDeniedExit()
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
   return (aliases, teachers, students)
 
 def _doInfoCourses(courseIdList):
@@ -47849,10 +47951,10 @@ def _doInfoCourses(courseIdList):
       Ind.Decrement()
     except GAPI.notFound:
       entityActionFailedWarning([Ent.COURSE, removeCourseIdScope(courseId)], Msg.DOES_NOT_EXIST, i, count)
-    except (GAPI.permissionDenied, GAPI.serviceNotAvailable) as e:
+    except GAPI.serviceNotAvailable as e:
       entityActionFailedWarning([Ent.COURSE, removeCourseIdScope(courseId)], str(e), i, count)
-    except GAPI.forbidden:
-      ClientAPIAccessDeniedExit()
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 # gam info courses <CourseEntity> [owneraccess]
 #	[owneremail] [alias|aliases] [show none|all|students|teachers] [countsonly]
@@ -47959,7 +48061,8 @@ def _getCoursesInfo(croom, courseSelectionParameters, courseShowProperties, getO
     courseId = addCourseIdScope(courseId)
     try:
       info = callGAPI(croom.courses(), 'get',
-                      throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.SERVICE_NOT_AVAILABLE],
+                      throwReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE,
+                                    GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                       retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                       id=courseId, fields=fields)
       coursesInfo.append(info)
@@ -47967,8 +48070,8 @@ def _getCoursesInfo(croom, courseSelectionParameters, courseShowProperties, getO
       entityDoesNotExistWarning(Ent.COURSE, courseId)
     except GAPI.serviceNotAvailable as e:
       entityActionFailedWarning([Ent.COURSE, courseId], str(e))
-    except GAPI.forbidden:
-      ClientAPIAccessDeniedExit()
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   return coursesInfo
 
 # gam print courses [todrive <ToDriveAttribute>*] (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
@@ -48931,43 +49034,73 @@ def doPrintCourseParticipants():
   csvPF.writeCSVfile('Course Participants')
 
 def _batchAddItemsToCourse(croom, courseId, i, count, addItems, addType):
+  def _addIdToResponse(response, riItem):
+    if addType == Ent.COURSE_ANNOUNCEMENT:
+      respId = response.get('id', '')
+    elif addType == Ent.COURSE_TOPIC:
+      respId = response.get('topicId', '')
+    else:
+      respId = ''
+    if respId:
+      return riItem + f'({respId})'
+    return riItem
+
   _ADD_PART_REASON_TO_MESSAGE_MAP = {GAPI.NOT_FOUND: Msg.DOES_NOT_EXIST,
                                      GAPI.ALREADY_EXISTS: Msg.DUPLICATE,
                                      GAPI.FAILED_PRECONDITION: Msg.NOT_ALLOWED}
-  def _callbackAddItemsToCourse(request_id, _, exception):
+  def _callbackAddItemsToCourse(request_id, response, exception):
     ri = request_id.splitlines()
+    if addType == Ent.COURSE_ANNOUNCEMENT:
+      mg = re.match(r"^{'text': '(.+)'}$", ri[RI_ITEM])
+      if mg:
+        riText = mg.group(1)
+      else:
+        riText = ''
+      if len(riText) > 100:
+        riItem = riText[0:100]+'...'
+      else:
+        riItem = riText
+    else:
+      riItem = ri[RI_ITEM]
     if exception is None:
-      entityActionPerformed([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], int(ri[RI_J]), int(ri[RI_JCOUNT]))
+      riItem = _addIdToResponse(response, riItem)
+      entityActionPerformed([Ent.COURSE, ri[RI_ENTITY], addType, riItem], int(ri[RI_J]), int(ri[RI_JCOUNT]))
     else:
       http_status, reason, message = checkGAPIError(exception)
-      if (reason not in {GAPI.QUOTA_EXCEEDED, GAPI.SERVICE_NOT_AVAILABLE}) and ((reason != GAPI.NOT_FOUND) or (ri[RI_ROLE] == Ent.COURSE_ALIAS)):
+      if (reason not in {GAPI.QUOTA_EXCEEDED, GAPI.SERVICE_NOT_AVAILABLE}) and ((reason != GAPI.NOT_FOUND) or (addType == Ent.COURSE_ALIAS)):
         if reason in [GAPI.FORBIDDEN, GAPI.BACKEND_ERROR]:
-          errMsg = getPhraseDNEorSNA(ri[RI_ITEM])
+          errMsg = getPhraseDNEorSNA(riItem)
         else:
           errMsg = getHTTPError(_ADD_PART_REASON_TO_MESSAGE_MAP, http_status, reason, message)
-          if (reason == GAPI.PERMISSION_DENIED) and (ri[RI_ROLE] in {Ent.STUDENT, Ent.TEACHER}) and ('CannotDirectAddUser' in errMsg):
-            errMsg += f' Add external user with: gam user {ri[RI_ITEM]} create classroominvitation courses {ri[RI_ENTITY]} addType {Ent.Singular(ri[RI_ROLE])}'
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], errMsg, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+          if (reason == GAPI.PERMISSION_DENIED) and (addType in {Ent.STUDENT, Ent.TEACHER}) and ('CannotDirectAddUser' in errMsg):
+            errMsg += f' Add external user with: gam user {riItem} create classroominvitation courses {ri[RI_ENTITY]} addType {Ent.Singular(addType)}'
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], addType, riItem], errMsg, int(ri[RI_J]), int(ri[RI_JCOUNT]))
         return
       waitOnFailure(1, 10, reason, message)
+      if addType in {Ent.STUDENT, Ent.TEACHER, Ent.COURSE_TOPIC}:
+        rbody = {attribute: riItem}
+      elif addType == Ent.COURSE_ALIAS:
+        rbody = {attribute: addCourseAliasScope(riItem)}
+      else: # addType == Ent.COURSE_ANNOUNCEMENT:
+        rbody = ri[RI_ITEM]
       try:
-        callGAPI(service, 'create',
-                 throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.BACKEND_ERROR,
-                               GAPI.ALREADY_EXISTS, GAPI.FAILED_PRECONDITION,
-                               GAPI.QUOTA_EXCEEDED, GAPI.SERVICE_NOT_AVAILABLE],
-                 retryReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE], triesLimit=0 if reason != GAPI.NOT_FOUND else 3,
-                 courseId=addCourseIdScope(ri[RI_ENTITY]),
-                 body={attribute: ri[RI_ITEM] if ri[RI_ROLE] != Ent.COURSE_ALIAS else addCourseAliasScope(ri[RI_ITEM])},
-                 fields='')
+        result = callGAPI(service, 'create',
+                          throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.BACKEND_ERROR,
+                                        GAPI.ALREADY_EXISTS, GAPI.FAILED_PRECONDITION,
+                                        GAPI.QUOTA_EXCEEDED, GAPI.SERVICE_NOT_AVAILABLE],
+                          retryReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE], triesLimit=0 if reason != GAPI.NOT_FOUND else 3,
+                          courseId=addCourseIdScope(ri[RI_ENTITY]), body=rbody, fields=returnFields)
+        riItem = _addIdToResponse(result, riItem)
       except (GAPI.notFound, GAPI.backendError, GAPI.forbidden):
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], getPhraseDNEorSNA(ri[RI_ITEM]), int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], addType, riItem], getPhraseDNEorSNA(riItem), int(ri[RI_J]), int(ri[RI_JCOUNT]))
       except GAPI.alreadyExists:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], Msg.DUPLICATE, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], addType, riItem], Msg.DUPLICATE, int(ri[RI_J]), int(ri[RI_JCOUNT]))
       except GAPI.failedPrecondition:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], Msg.NOT_ALLOWED, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], addType, riItem], Msg.NOT_ALLOWED, int(ri[RI_J]), int(ri[RI_JCOUNT]))
       except (GAPI.quotaExceeded, GAPI.serviceNotAvailable) as e:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], str(e), int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], addType, riItem], str(e), int(ri[RI_J]), int(ri[RI_JCOUNT]))
 
+  returnFields = ''
   if addType == Ent.STUDENT:
     service = croom.courses().students()
     attribute = 'userId'
@@ -48980,16 +49113,18 @@ def _batchAddItemsToCourse(croom, courseId, i, count, addItems, addType):
   elif addType == Ent.COURSE_TOPIC:
     service = croom.courses().topics()
     attribute = 'name'
+    returnFields = 'topicId'
   else: # addType == Ent.COURSE_ANNOUNCEMENT:
     service = croom.courses().announcements()
     attribute = 'text'
+    returnFields = 'id'
   method = getattr(service, 'create')
   Act.Set(Act.ADD)
   jcount = len(addItems)
   noScopeCourseId = removeCourseIdScope(courseId)
   entityPerformActionNumItems([Ent.COURSE, noScopeCourseId], jcount, addType, i, count)
   Ind.Increment()
-  svcargs = dict([('courseId', courseId), ('body', {attribute: None}), ('fields', '')]+GM.Globals[GM.EXTRA_ARGS_LIST])
+  svcargs = dict([('courseId', courseId), ('body', {attribute: None}), ('fields', returnFields)]+GM.Globals[GM.EXTRA_ARGS_LIST])
   dbatch = croom.new_batch_http_request(callback=_callbackAddItemsToCourse)
   bcount = 0
   j = 0
@@ -49021,34 +49156,37 @@ def _batchRemoveItemsFromCourse(croom, courseId, i, count, removeItems, removeTy
                                         GAPI.PERMISSION_DENIED: Msg.PERMISSION_DENIED}
   def _callbackRemoveItemsFromCourse(request_id, _, exception):
     ri = request_id.splitlines()
+    riItem = ri[RI_ITEM]
     if exception is None:
-      entityActionPerformed([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], int(ri[RI_J]), int(ri[RI_JCOUNT]))
+      entityActionPerformed([Ent.COURSE, ri[RI_ENTITY], removeType, riItem], int(ri[RI_J]), int(ri[RI_JCOUNT]))
     else:
       http_status, reason, message = checkGAPIError(exception)
       if reason not in {GAPI.QUOTA_EXCEEDED, GAPI.SERVICE_NOT_AVAILABLE}:
-        if reason == GAPI.NOT_FOUND and ri[RI_ROLE] != Ent.COURSE_ALIAS:
-          errMsg = f'{Msg.NOT_A} {Ent.Singular(ri[RI_ROLE])}'
+        if reason == GAPI.NOT_FOUND and removeType != Ent.COURSE_ALIAS:
+          errMsg = f'{Msg.NOT_A} {Ent.Singular(removeType)}'
         else:
           errMsg = getHTTPError(_REMOVE_PART_REASON_TO_MESSAGE_MAP, http_status, reason, message)
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], errMsg, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], removeType, riItem], errMsg, int(ri[RI_J]), int(ri[RI_JCOUNT]))
         return
       waitOnFailure(1, 10, reason, message)
+      if removeType in {Ent.STUDENT, Ent.TEACHER, Ent.COURSE_TOPIC, Ent.COURSE_ANNOUNCEMENT}:
+        rbody = {attribute: riItem}
+      else: # removeType == Ent.COURSE_ALIAS:
+        rbody = {attribute: addCourseAliasScope(riItem)}
       try:
         callGAPI(service, 'delete',
                  throwReasons=[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED,
                                GAPI.QUOTA_EXCEEDED, GAPI.SERVICE_NOT_AVAILABLE, GAPI.FAILED_PRECONDITION],
                  retryReasons=[GAPI.NOT_FOUND, GAPI.SERVICE_NOT_AVAILABLE], triesLimit=0 if reason != GAPI.NOT_FOUND else 3,
-                 courseId=addCourseIdScope(ri[RI_ENTITY]),
-                 body={attribute: ri[RI_ITEM] if ri[RI_ROLE] != Ent.COURSE_ALIAS else addCourseAliasScope(ri[RI_ITEM])},
-                 fields='')
+                 courseId=addCourseIdScope(ri[RI_ENTITY]), body=rbody, fields='')
       except GAPI.notFound:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], Msg.DOES_NOT_EXIST, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], removeType, riItem], Msg.DOES_NOT_EXIST, int(ri[RI_J]), int(ri[RI_JCOUNT]))
       except GAPI.forbidden:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], Msg.FORBIDDEN, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], removeType, riItem], Msg.FORBIDDEN, int(ri[RI_J]), int(ri[RI_JCOUNT]))
       except GAPI.permissionDenied:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], Msg.PERMISSION_DENIED, int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], removeType, riItem], Msg.PERMISSION_DENIED, int(ri[RI_J]), int(ri[RI_JCOUNT]))
       except (GAPI.quotaExceeded, GAPI.serviceNotAvailable, GAPI.failedPrecondition) as e:
-        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], ri[RI_ROLE], ri[RI_ITEM]], str(e), int(ri[RI_J]), int(ri[RI_JCOUNT]))
+        entityActionFailedWarning([Ent.COURSE, ri[RI_ENTITY], removeType, riItem], str(e), int(ri[RI_J]), int(ri[RI_JCOUNT]))
 
   if removeType == Ent.STUDENT:
     service = croom.courses().students()
@@ -49121,8 +49259,8 @@ def getCourseAnnouncement(createCmd):
   body = {}
   while Cmd.ArgumentsRemaining():
     myarg = getArgument()
-    if myarg == 'text':
-      body['text'] = getString(Cmd.OB_STRING, minLen=1, maxLen=30000)
+    if myarg in SORF_TEXT_ARGUMENTS:
+      body['text'] = getStringOrFile(myarg, minLen=1, unescapeCRLF=True)[0]
     elif myarg == 'scheduledtime':
       body['scheduledTime'] = getTimeOrDeltaFromNow()
     elif myarg == 'state':
@@ -49160,9 +49298,9 @@ PARTICIPANT_EN_MAP = {
 # gam courses <CourseEntity> create alias <CourseAliasEntity>
 # gam course <CourseID> create alias <CourseAlias>
 # gam courses <CourseEntity> create announcement
-#	text <String> [scheduledtime <Time>] [state draft|published]
+#	<CourseAnnouncementContent> [scheduledtime <Time>] [state draft|published]
 # gam course <CourseID> create announcement
-#	text <String> [scheduledtime <Time>] [state draft|published]
+#	<CourseAnnouncementContent> [scheduledtime <Time>] [state draft|published]
 # gam courses <CourseEntity> create topic <CourseTopicEntity>
 # gam course <CourseID> create topic <CourseTopic>
 # gam courses <CourseEntity> create students <UserTypeEntity>
@@ -49270,9 +49408,9 @@ def doCourseRemoveItems(courseIdList, getEntityListArg):
     _batchRemoveItemsFromCourse(courseInfo['croom'], courseId, i, count, removeItems, removeType)
 
 # gam courses <CourseEntity> update announcement <CourseAnnouncemntIDEntity>
-#	[text <String>] [scheduledtime <Time>] [state published]
+#	[<CourseAnnouncementContent>] [scheduledtime <Time>] [state published]
 # gam course <CourseID> update announcement <CourseAnnouncementID>
-#	[text <String>] [scheduledtime <Time>] [state published]
+#	[<CourseAnnouncementContent>] [scheduledtime <Time>] [state published]
 # gam courses <CourseEntity> update topic <CourseTopicIDEntity> <CourseTopic>
 # gam course <CourseID> update topic <CourseTopicID> <CourseTopic>
 def doCourseUpdateItems(courseIdList, getEntityListArg):
@@ -49520,7 +49658,8 @@ def _cancelGuardianInvitation(croom, studentId, invitationId, i=0, count=0, j=0,
     entityActionFailedWarning([Ent.STUDENT, studentId, Ent.GUARDIAN_INVITATION, invitationId], str(e), j, jcount)
     return -1
   except (GAPI.forbidden, GAPI.permissionDenied) as e:
-    studentUnknownWarning(studentId, str(e), i, count)
+    ClientAPIAccessDeniedExit(str(e))
+#    studentUnknownWarning(studentId, str(e), i, count)
     return -1
 
 # gam cancel guardianinvitation|guardianinvitations <GuardianInvitationID> <StudentItem>
@@ -49565,7 +49704,8 @@ def _deleteGuardian(croom, studentId, guardianId, guardianEmail, i, count, j, jc
     entityActionFailedWarning([Ent.STUDENT, studentId, Ent.GUARDIAN, guardianEmail], str(e), j, jcount)
     return -1
   except (GAPI.forbidden, GAPI.permissionDenied) as e:
-    studentUnknownWarning(studentId, str(e), i, count)
+    ClientAPIAccessDeniedExit(str(e))
+#    studentUnknownWarning(studentId, str(e), i, count)
     return -1
 
 def _doDeleteGuardian(croom, studentId, guardianId, guardianClass, i=0, count=0, j=0, jcount=0):
@@ -52675,7 +52815,8 @@ def doSharedDriveSearch(drive, user, i, count, query, useDomainAdminAccess):
                           pageMessage=getPageMessageForWhom(),
                           throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.INVALID_QUERY, GAPI.INVALID,
                                                                       GAPI.QUERY_REQUIRES_ADMIN_CREDENTIALS,
-                                                                      GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE],
+                                                                      GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE,
+                                                                      GAPI.INSUFFICIENT_ADMINISTRATOR_PRIVILEGES],
                           q=query, useDomainAdminAccess=useDomainAdminAccess,
                           fields='nextPageToken,drives(id)', pageSize=100)
     if files:
@@ -52683,7 +52824,7 @@ def doSharedDriveSearch(drive, user, i, count, query, useDomainAdminAccess):
     entityActionNotPerformedWarning([Ent.USER, user, Ent.DRIVE_FILE, None], emptyQuery(query, Ent.SHAREDDRIVE), i, count)
   except (GAPI.invalidQuery, GAPI.invalid):
     entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE, None], invalidQuery(query), i, count)
-  except (GAPI.queryRequiresAdminCredentials, GAPI.noListTeamDrivesAdministratorPrivilege) as e:
+  except (GAPI.queryRequiresAdminCredentials, GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.insufficientAdministratorPrivileges) as e:
     entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE, None], str(e), i, count)
   except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
     userDriveServiceNotEnabledWarning(user, str(e), i, count)
@@ -52986,7 +53127,11 @@ def _convertSharedDriveNameToId(drive, user, i, count, fileIdEntity, useDomainAd
     else:
       name = fileIdEntity['shareddrivename'].replace("'", "\\'")
     tdlist = callGAPIpages(drive.drives(), 'list', 'drives',
-                           throwReasons=GAPI.DRIVE_USER_THROW_REASONS,
+                           throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.INVALID_QUERY, GAPI.INVALID,
+                                                                       GAPI.QUERY_REQUIRES_ADMIN_CREDENTIALS,
+                                                                       GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE,
+                                                                       GAPI.INSUFFICIENT_ADMINISTRATOR_PRIVILEGES,
+                                                                       GAPI.FILE_NOT_FOUND],
                            useDomainAdminAccess=useDomainAdminAccess,
                            q=f"name='{name}'",
                            fields='nextPageToken,drives(id,name)', pageSize=100)
@@ -52995,13 +53140,19 @@ def _convertSharedDriveNameToId(drive, user, i, count, fileIdEntity, useDomainAd
     if not tdlist:
       name = fileIdEntity['shareddrivename'].lower()
       feed = callGAPIpages(drive.drives(), 'list', 'drives',
-                           throwReasons=GAPI.DRIVE_USER_THROW_REASONS,
+                           throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE,
+                                                                       GAPI.INSUFFICIENT_ADMINISTRATOR_PRIVILEGES],
                            useDomainAdminAccess=useDomainAdminAccess,
                            fields='nextPageToken,drives(id,name)', pageSize=100)
       tdlist = [td for td in feed if td['name'].lower() == name]
   except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy):
     entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_NAME, fileIdEntity['shareddrivename']], Msg.DOES_NOT_EXIST, i, count)
     return False
+  except (GAPI.invalidQuery, GAPI.invalid, GAPI.queryRequiresAdminCredentials,
+          GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.insufficientAdministratorPrivileges,
+          GAPI.fileNotFound) as e:
+    entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_NAME, fileIdEntity['shareddrivename']], str(e), i, count)
+    return False
   jcount = len(tdlist)
   if jcount == 1:
     fileIdEntity['shareddrive']['driveId'] = tdlist[0]['id']
@@ -53019,10 +53170,10 @@ def _getSharedDriveNameFromId(drive, sharedDriveId, useDomainAdminAccess=False):
   if not sharedDriveName:
     try:
       sharedDriveName = callGAPI(drive.drives(), 'get',
-                                 throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                                 throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                                  useDomainAdminAccess=useDomainAdminAccess,
                                  driveId=sharedDriveId, fields='name')['name']
-    except (GAPI.notFound, GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy):
+    except (GAPI.fileNotFound, GAPI.notFound, GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy):
       sharedDriveName = TEAM_DRIVE
     GM.Globals[GM.MAP_SHAREDDRIVE_ID_TO_NAME][sharedDriveId] = sharedDriveName
   return sharedDriveName
@@ -53043,7 +53194,7 @@ def _getDriveFileNameFromId(drive, fileId, combineTitleId=True, useDomainAdminAc
     if useDomainAdminAccess:
       try:
         result = callGAPI(drive.drives(), 'get',
-                          throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                          throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                           useDomainAdminAccess=useDomainAdminAccess,
                           driveId=fileId, fields='name')
         if result:
@@ -53051,7 +53202,7 @@ def _getDriveFileNameFromId(drive, fileId, combineTitleId=True, useDomainAdminAc
           if combineTitleId:
             fileName += '('+fileId+')'
           return (fileName, Ent.DRIVE_FOLDER, MIMETYPE_GA_FOLDER)
-      except GAPI.notFound:
+      except (GAPI.fileNotFound, GAPI.notFound):
         pass
   except (GAPI.forbidden, GAPI.internalError, GAPI.insufficientFilePermissions, GAPI.internalError,
           GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy):
@@ -53217,7 +53368,7 @@ def _getDriveFileParentInfo(drive, user, i, count, body, parameters, emptyQueryO
         _setSearchArgs(result['driveId'])
       else:
         result = callGAPI(drive.drives(), 'get',
-                          throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                          throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                           driveId=parameters[DFA_SHAREDDRIVE_PARENTID], fields='id')
         parameters[DFA_KWARGS]['corpora'] = 'drive'
         parameters[DFA_KWARGS]['driveId'] = result['id']
@@ -54427,6 +54578,7 @@ DRIVE_CAPABILITIES_SUBFIELDS_CHOICE_MAP = {
   'canaddmydriveparent': 'canAddMyDriveParent',
   'canchangecopyrequireswriterpermission': 'canChangeCopyRequiresWriterPermission',
   'canchangecopyrequireswriterpermissionrestriction': 'canChangeCopyRequiresWriterPermissionRestriction',
+  'canchangedownloadrestriction': 'canChangeDownloadRestriction',
   'canchangedomainusersonlyrestriction': 'canChangeDomainUsersOnlyRestriction',
   'canchangedrivebackground': 'canChangeDriveBackground',
   'canchangedrivemembersonlyrestriction': 'canChangeDriveMembersOnlyRestriction',
@@ -55443,7 +55595,7 @@ def initFileTree(drive, shareddrive, DLP, shareddriveFields, showParent, user, i
       f_file['parents'] = []
       fileTree[f_file['id']] = {'info': f_file, 'noParents': True, 'children': []}
       name = callGAPI(drive.drives(), 'get',
-                      throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                      throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                       driveId=fileId, fields='name')['name']
       fileTree[f_file['id']]['info']['name'] = f'{SHARED_DRIVES}/{name}'
     else:
@@ -56629,12 +56781,12 @@ def printFileList(users):
           rootFolderId = fileIdEntity['shareddrive']['driveId']
           if not fileIdEntity['shareddrivename']:
             fileIdEntity['shareddrivename'] = callGAPI(drive.drives(), 'get',
-                                                     throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND, GAPI.FILE_NOT_FOUND],
+                                                     throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                                                      driveId=rootFolderId, fields='name')['name']
           rootFolderName = fileIdEntity['shareddrivename']
         if not showParentsIdsAsList and DFF.parentsSubFields['isRoot']:
           DFF.parentsSubFields['rootFolderId'] = rootFolderId
-      except (GAPI.notFound, GAPI.fileNotFound) as e:
+      except (GAPI.fileNotFound, GAPI.notFound) as e:
         entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, fileIdEntity['shareddrive']['driveId']], str(e), i, count)
         continue
       except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
@@ -65496,6 +65648,8 @@ SHAREDDRIVE_RESTRICTIONS_MAP = {
   'allowcontentmanagerstosharefolders': 'sharingFoldersRequiresOrganizerPermission',
   'copyrequireswriterpermission': 'copyRequiresWriterPermission',
   'domainusersonly': 'domainUsersOnly',
+  'downloadrestrictedforreaders': 'restrictedForReaders',
+  'downloadrestrictedforwriters': 'restrictedForWriters',
   'drivemembersonly': 'driveMembersOnly',
   'sharingfoldersrequiresorganizerpermission': 'sharingFoldersRequiresOrganizerPermission',
   'teammembersonly': 'driveMembersOnly',
@@ -65504,7 +65658,10 @@ SHAREDDRIVE_RESTRICTIONS_MAP = {
 def _getSharedDriveRestrictions(myarg, body):
   def _setRestriction(restriction):
     body.setdefault('restrictions', {})
-    if restriction != 'allowcontentmanagerstosharefolders':
+    if restriction in {'downloadrestrictedforreaders', 'downloadrestrictedforwriters'}:
+      body['restrictions'].setdefault('downloadRestriction', {})
+      body['restrictions']['downloadRestriction'][SHAREDDRIVE_RESTRICTIONS_MAP[restriction]] = getBoolean()
+    elif restriction != 'allowcontentmanagerstosharefolders':
       body['restrictions'][SHAREDDRIVE_RESTRICTIONS_MAP[restriction]] = getBoolean()
     else:
       body['restrictions'][SHAREDDRIVE_RESTRICTIONS_MAP[restriction]] = not getBoolean()
@@ -65657,12 +65814,12 @@ def createSharedDrive(users, useDomainAdminAccess=False):
     while not created:
       try:
         callGAPI(drive.drives(), 'get',
-                 throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                 throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                  useDomainAdminAccess=useDomainAdminAccess,
                  driveId=driveId, fields='id')
         created = True
         break
-      except GAPI.notFound as e:
+      except (GAPI.fileNotFound, GAPI.notFound) as e:
         retry += 1
         if retry > errorRetries:
           entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, driveId], str(e), i, count)
@@ -65678,6 +65835,7 @@ def createSharedDrive(users, useDomainAdminAccess=False):
                    bailOnInternalError=True,
                    throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND, GAPI.FORBIDDEN,
                                                                GAPI.NO_MANAGE_TEAMDRIVE_ADMINISTRATOR_PRIVILEGE,
+                                                               GAPI.OUTSIDE_DOMAIN_MEMBER_CANNOT_CHANGE_TEAMDRIVE_RESTRICTIONS,
                                                                GAPI.BAD_REQUEST, GAPI.INTERNAL_ERROR, GAPI.PERMISSION_DENIED,
                                                                GAPI.FILE_NOT_FOUND],
                    useDomainAdminAccess=useDomainAdminAccess, driveId=driveId, body=updateBody)
@@ -65697,7 +65855,8 @@ def createSharedDrive(users, useDomainAdminAccess=False):
       if orgUnit:
         waitingForCreationToComplete(moveToOrgUnitDelay)
         ci = _moveSharedDriveToOU(orgUnit, orgUnitId, driveId, user, i, count, ci, returnIdOnly or csvPF)
-    except (GAPI.notFound, GAPI.forbidden, GAPI.badRequest, GAPI.noManageTeamDriveAdministratorPrivilege) as e:
+    except (GAPI.notFound, GAPI.forbidden, GAPI.badRequest,
+            GAPI.noManageTeamDriveAdministratorPrivilege, GAPI.outsideDomainMemberCannotChangeTeamDriveRestrictions) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, driveId], str(e), i, count)
     except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
       userDriveServiceNotEnabledWarning(user, str(e), i, count)
@@ -65752,6 +65911,7 @@ def updateSharedDrive(users, useDomainAdminAccess=False):
                           bailOnInternalError=True,
                           throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND, GAPI.FORBIDDEN, GAPI.BAD_REQUEST,
                                                                       GAPI.NO_MANAGE_TEAMDRIVE_ADMINISTRATOR_PRIVILEGE,
+                                                                      GAPI.OUTSIDE_DOMAIN_MEMBER_CANNOT_CHANGE_TEAMDRIVE_RESTRICTIONS,
                                                                       GAPI.INTERNAL_ERROR, GAPI.FILE_NOT_FOUND],
                           useDomainAdminAccess=useDomainAdminAccess, driveId=driveId, body=body, fields='name')
         entityActionPerformed([Ent.USER, user, Ent.SHAREDDRIVE_NAME, result['name'], Ent.SHAREDDRIVE_ID, driveId], i, count)
@@ -65769,7 +65929,7 @@ def updateSharedDrive(users, useDomainAdminAccess=False):
       if orgUnit:
         ci = _moveSharedDriveToOU(orgUnit, orgUnitId, driveId, user, i, count, ci, False)
     except (GAPI.notFound, GAPI.forbidden, GAPI.badRequest, GAPI.internalError,
-            GAPI.noManageTeamDriveAdministratorPrivilege) as e:
+            GAPI.noManageTeamDriveAdministratorPrivilege, GAPI.outsideDomainMemberCannotChangeTeamDriveRestrictions) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, driveId], str(e), i, count)
     except GAPI.fileNotFound as e:
       entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, driveId,
@@ -65898,14 +66058,6 @@ def _getSharedDriveRole(shareddrive):
   return role
 
 def _showSharedDrive(user, shareddrive, j, jcount, FJQC):
-  def _showCapabilitiesRestrictions(field):
-    if field in shareddrive:
-      printKeyValueList([field, ''])
-      Ind.Increment()
-      for capability in sorted(shareddrive[field]):
-        printKeyValueList([capability, shareddrive[field][capability]])
-      Ind.Decrement()
-
   if FJQC.formatJSON:
     printLine(json.dumps(cleanJSON(shareddrive, timeObjects=SHAREDDRIVE_TIME_OBJECTS), ensure_ascii=False, sort_keys=True))
     return
@@ -65922,8 +66074,9 @@ def _showSharedDrive(user, shareddrive, j, jcount, FJQC):
       printKeyValueList([setting, shareddrive[setting]])
   if 'role' in shareddrive:
     printKeyValueList(['role', shareddrive['role']])
-  _showCapabilitiesRestrictions('capabilities')
-  _showCapabilitiesRestrictions('restrictions')
+  for setting in ['capabilities', 'restrictions']:
+    if setting in shareddrive:
+      showJSON(setting, shareddrive[setting])
   Ind.Decrement()
 
 # gam <UserTypeEntity> info shareddrive <SharedDriveEntity>
@@ -65955,14 +66108,14 @@ def infoSharedDrive(users, useDomainAdminAccess=False):
     try:
       driveId = fileIdEntity['shareddrive']['driveId']
       shareddrive = callGAPI(drive.drives(), 'get',
-                             throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                             throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                              useDomainAdminAccess=useDomainAdminAccess,
                              driveId=driveId, fields=fields)
       role = _getSharedDriveRole(shareddrive)
       if role:
         shareddrive['role'] = role if not guiRoles else SHAREDDRIVE_API_GUI_ROLES_MAP[role]
       _showSharedDrive(user, shareddrive, i, count, FJQC)
-    except GAPI.notFound as e:
+    except (GAPI.fileNotFound, GAPI.notFound) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE_ID, driveId], str(e), i, count)
     except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
       userDriveServiceNotEnabledWarning(user, str(e), i, count)
@@ -66116,11 +66269,13 @@ def printShowSharedDrives(users, useDomainAdminAccess=False):
                            throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.INVALID_QUERY, GAPI.INVALID,
                                                                        GAPI.QUERY_REQUIRES_ADMIN_CREDENTIALS,
                                                                        GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE,
+                                                                       GAPI.INSUFFICIENT_ADMINISTRATOR_PRIVILEGES,
                                                                        GAPI.FILE_NOT_FOUND],
                            q=query, useDomainAdminAccess=useDomainAdminAccess,
                            fields='*', pageSize=100)
     except (GAPI.invalidQuery, GAPI.invalid, GAPI.queryRequiresAdminCredentials,
-            GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.fileNotFound) as e:
+            GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.insufficientAdministratorPrivileges,
+            GAPI.fileNotFound) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE, None], str(e), i, count)
       continue
     except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
@@ -66455,8 +66610,10 @@ def printShowSharedDriveACLs(users, useDomainAdminAccess=False):
       if userdrive is not None:
         try:
           feed = callGAPIpages(userdrive.drives(), 'list', 'drives',
-                               throwReasons=GAPI.DRIVE_USER_THROW_REASONS,
+                               throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.INVALID, GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE],
                                fields='nextPageToken,drives(id,name,createdTime,orgUnitId)', pageSize=100)
+        except (GAPI.invalid, GAPI.noListTeamDrivesAdministratorPrivilege):
+          pass
         except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy):
           pass
     if feed is None:
@@ -66471,10 +66628,12 @@ def printShowSharedDriveACLs(users, useDomainAdminAccess=False):
                              pageMessage=pageMessage,
                              throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.INVALID_QUERY, GAPI.INVALID,
                                                                          GAPI.QUERY_REQUIRES_ADMIN_CREDENTIALS,
-                                                                         GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE],
+                                                                         GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE,
+                                                                         GAPI.INSUFFICIENT_ADMINISTRATOR_PRIVILEGES],
                              q=query, useDomainAdminAccess=useDomainAdminAccess,
                              fields='nextPageToken,drives(id,name,createdTime,orgUnitId)', pageSize=100)
-      except (GAPI.invalidQuery, GAPI.invalid, GAPI.queryRequiresAdminCredentials, GAPI.noListTeamDrivesAdministratorPrivilege) as e:
+      except (GAPI.invalidQuery, GAPI.invalid, GAPI.queryRequiresAdminCredentials,
+              GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.insufficientAdministratorPrivileges) as e:
         entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE, None], str(e), i, count)
         continue
       except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
@@ -66705,11 +66864,11 @@ def printSharedDriveOrganizers(users, useDomainAdminAccess=False):
                              throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.INVALID_QUERY, GAPI.INVALID,
                                                                          GAPI.QUERY_REQUIRES_ADMIN_CREDENTIALS,
                                                                          GAPI.NO_LIST_TEAMDRIVES_ADMINISTRATOR_PRIVILEGE,
-                                                                         GAPI.FILE_NOT_FOUND],
+                                                                         GAPI.INSUFFICIENT_ADMINISTRATOR_PRIVILEGES],
                              q=query, useDomainAdminAccess=useDomainAdminAccess,
                              fields='nextPageToken,drives(id,name,createdTime,orgUnitId)', pageSize=100)
       except (GAPI.invalidQuery, GAPI.invalid, GAPI.queryRequiresAdminCredentials,
-              GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.fileNotFound) as e:
+              GAPI.noListTeamDrivesAdministratorPrivilege, GAPI.insufficientAdministratorPrivileges) as e:
         entityActionFailedWarning([Ent.USER, user, Ent.SHAREDDRIVE, None], str(e), i, count)
         continue
       except (GAPI.serviceNotAvailable, GAPI.authError, GAPI.domainPolicy) as e:
@@ -66723,7 +66882,7 @@ def printSharedDriveOrganizers(users, useDomainAdminAccess=False):
         j +=1
         try:
           feed.append(callGAPI(drive.drives(), 'get',
-                               throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.NOT_FOUND],
+                               throwReasons=GAPI.DRIVE_USER_THROW_REASONS+[GAPI.FILE_NOT_FOUND, GAPI.NOT_FOUND],
                                useDomainAdminAccess=useDomainAdminAccess,
                                driveId=driveId, fields='id,name,createdTime,orgUnitId'))
         except (GAPI.fileNotFound, GAPI.notFound) as e:
@@ -67179,7 +67338,7 @@ def _addUserToGroups(cd, user, addGroupsSet, addGroups, i, count):
                retryReasons=GAPI.MEMBERS_RETRY_REASONS,
                groupKey=group, body=body, fields='')
       entityActionPerformed([Ent.GROUP, group, role, user], j, jcount)
-    except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid, GAPI.forbidden):
+    except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid):
       entityUnknownWarning(Ent.GROUP, group, j, jcount)
     except (GAPI.duplicate, GAPI.cyclicMembershipsNotAllowed, GAPI.conditionNotMet, GAPI.serviceNotAvailable) as e:
       entityActionFailedWarning([Ent.GROUP, group, role, user], str(e), j, jcount)
@@ -67187,6 +67346,8 @@ def _addUserToGroups(cd, user, addGroupsSet, addGroups, i, count):
       entityActionPerformedMessage([Ent.GROUP, group, role, user], Msg.ACTION_MAY_BE_DELAYED, j, jcount)
     except (GAPI.memberNotFound, GAPI.resourceNotFound, GAPI.invalidMember) as e:
       entityActionFailedWarning([Ent.USER, user], str(e), i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   Ind.Decrement()
 
 # gam <UserTypeEntity> add group|groups
@@ -67246,12 +67407,14 @@ def _deleteUserFromGroups(cd, user, deleteGroupsSet, deleteGroups, i, count):
                retryReasons=GAPI.MEMBERS_RETRY_REASONS,
                groupKey=group, memberKey=user)
       entityActionPerformed([Ent.GROUP, group, role, user], j, jcount)
-    except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid, GAPI.forbidden):
+    except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid):
       entityUnknownWarning(Ent.GROUP, group, j, jcount)
     except (GAPI.memberNotFound, GAPI.invalidMember, GAPI.conditionNotMet, GAPI.serviceNotAvailable) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.GROUP, group], str(e), j, jcount)
     except GAPI.conflict:
       entityActionPerformedMessage([Ent.GROUP, group, role, user], Msg.ACTION_MAY_BE_DELAYED, j, jcount)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   Ind.Decrement()
 
 def _getUserGroupOptionalDomainCustomerId():
@@ -67318,8 +67481,10 @@ def deleteUserFromGroups(users):
       except (GAPI.invalidMember, GAPI.invalidInput):
         badRequestWarning(Ent.GROUP, Ent.MEMBER, user)
         continue
-      except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.forbidden, GAPI.badRequest):
+      except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.badRequest):
         accessErrorExit(cd)
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
       deleteGroups = {}
       for group in result:
         if not matchPattern or checkUserGroupMatchPattern(group['email'], matchPattern):
@@ -67348,10 +67513,12 @@ def _updateUserGroups(cd, user, updateGroupsSet, updateGroups, i, count):
                retryReasons=GAPI.MEMBERS_RETRY_REASONS,
                groupKey=group, memberKey=user, body=body, fields='')
       entityActionPerformed([Ent.GROUP, group, role, user], j, jcount)
-    except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid, GAPI.forbidden):
+    except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid):
       entityUnknownWarning(Ent.GROUP, group, j, jcount)
     except (GAPI.memberNotFound, GAPI.invalidMember, GAPI.conditionNotMet, GAPI.serviceNotAvailable) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.GROUP, group], str(e), j, jcount)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   Ind.Decrement()
 
 # gam <UserTypeEntity> update group|groups
@@ -67398,8 +67565,10 @@ def updateUserGroups(users):
       except (GAPI.invalidMember, GAPI.invalidInput):
         badRequestWarning(Ent.GROUP, Ent.MEMBER, user)
         continue
-      except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.forbidden, GAPI.badRequest):
+      except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.badRequest):
         accessErrorExit(cd)
+      except (GAPI.forbidden, GAPI.permissionDenied) as e:
+        ClientAPIAccessDeniedExit(str(e))
       updateGroups = {}
       for group in result:
         updateGroups[group['email']] = {'role': baseRole, 'delivery_settings': baseDeliverySettings}
@@ -67473,8 +67642,10 @@ def syncUserWithGroups(users):
     except (GAPI.invalidMember, GAPI.invalidInput):
       badRequestWarning(Ent.GROUP, Ent.MEMBER, user)
       continue
-    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.forbidden, GAPI.badRequest):
+    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.badRequest):
       accessErrorExit(cd)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
     for groupEntity in entityList:
       groupEmail = groupEntity['email']
       try:
@@ -67593,7 +67764,7 @@ def checkUserInGroups(users):
                             retryReasons=GAPI.MEMBERS_RETRY_REASONS,
                             groupKey=groupEmail, memberKey=user, fields='role')
           _checkMember(result)
-        except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid, GAPI.forbidden):
+        except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid):
           entityUnknownWarning(Ent.GROUP, groupEmail, j, jcount)
           _setCheckError()
         except GAPI.memberNotFound:
@@ -67605,6 +67776,8 @@ def checkUserInGroups(users):
         except (GAPI.invalidMember, GAPI.conditionNotMet, GAPI.serviceNotAvailable) as e:
           entityActionFailedWarning([Ent.USER, user, Ent.GROUP, groupEmail], str(e), j, jcount)
           _setCheckError()
+        except (GAPI.forbidden, GAPI.permissionDenied) as e:
+          ClientAPIAccessDeniedExit(str(e))
       else:
         try:
           result = callGAPIpages(cd.members(), 'list', 'members',
@@ -67622,12 +67795,14 @@ def checkUserInGroups(users):
             else:
               csvPF.WriteRow({'user': user, 'group': groupEmail, 'role': notMemberOrRole})
             _setCheckError()
-        except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid, GAPI.forbidden):
+        except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.invalid):
           entityUnknownWarning(Ent.GROUP, groupEmail, j, jcount)
           _setCheckError()
         except (GAPI.invalidMember, GAPI.conditionNotMet, GAPI.serviceNotAvailable) as e:
           entityActionFailedWarning([Ent.USER, user, Ent.GROUP, groupEmail], str(e), j, jcount)
           _setCheckError()
+        except (GAPI.forbidden, GAPI.permissionDenied) as e:
+          ClientAPIAccessDeniedExit(str(e))
     Ind.Decrement()
   if csvPF:
     csvPF.writeCSVfile('User Check Groups')
@@ -67706,11 +67881,13 @@ def printShowUserGroups(users):
     except (GAPI.invalidMember, GAPI.invalidInput):
       badRequestWarning(Ent.GROUP, Ent.MEMBER, user)
       continue
-    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.forbidden, GAPI.badRequest):
+    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.badRequest):
       if kwargs.get('domain'):
         badRequestWarning(Ent.GROUP, Ent.DOMAIN, kwargs['domain'])
         return
       accessErrorExit(cd)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
     jcount = len(entityList)
     if totalOnly:
       if not csvPF:
@@ -67840,6 +68017,8 @@ def printShowGroupTree(users):
     except (GAPI.invalidMember, GAPI.invalidInput):
       entityUnknownWarning(Ent.USER, user, i, count)
       continue
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
     j = 0
     jcount = len(groups)
     if not csvPF and not FJQC.formatJSON:
@@ -67932,11 +68111,13 @@ def printUserGroupsList(users):
     except (GAPI.invalidMember, GAPI.invalidInput):
       badRequestWarning(Ent.GROUP, Ent.MEMBER, user)
       continue
-    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.forbidden, GAPI.badRequest):
+    except (GAPI.resourceNotFound, GAPI.domainNotFound, GAPI.badRequest):
       if kwargs.get('domain'):
         badRequestWarning(Ent.GROUP, Ent.DOMAIN, kwargs['domain'])
         return
       accessErrorExit(cd)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
     csvPF.WriteRow({'User': user, 'Groups': len(entityList), 'GroupsList': delimiter.join([group['email'] for group in entityList])})
   csvPF.writeCSVfile('User GroupsList')
 
@@ -69119,19 +69300,23 @@ def deleteTokens(users):
     try:
       callGAPI(cd.tokens(), 'get',
                throwReasons=[GAPI.USER_NOT_FOUND, GAPI.DOMAIN_NOT_FOUND,
-                             GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.FORBIDDEN,
-                             GAPI.NOT_FOUND, GAPI.RESOURCE_NOT_FOUND],
+                             GAPI.DOMAIN_CANNOT_USE_APIS,
+                             GAPI.NOT_FOUND, GAPI.RESOURCE_NOT_FOUND,
+                             GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                userKey=user, clientId=clientId, fields='')
       callGAPI(cd.tokens(), 'delete',
                throwReasons=[GAPI.USER_NOT_FOUND, GAPI.DOMAIN_NOT_FOUND,
-                             GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.FORBIDDEN,
-                             GAPI.NOT_FOUND, GAPI.RESOURCE_NOT_FOUND],
+                             GAPI.DOMAIN_CANNOT_USE_APIS,
+                             GAPI.NOT_FOUND, GAPI.RESOURCE_NOT_FOUND,
+                             GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                userKey=user, clientId=clientId)
       entityActionPerformed([Ent.USER, user, Ent.ACCESS_TOKEN, clientId], i, count)
     except (GAPI.notFound, GAPI.resourceNotFound) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.ACCESS_TOKEN, clientId], str(e), i, count)
-    except (GAPI.userNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden):
+    except (GAPI.userNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis):
       entityUnknownWarning(Ent.USER, user, i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
 
 TOKENS_FIELDS_TITLES = ['clientId', 'displayText', 'anonymous', 'nativeApp', 'userKey', 'scopes']
 TOKENS_AGGREGATE_FIELDS_TITLES = ['clientId', 'displayText', 'anonymous', 'nativeApp', 'users', 'scopes']
@@ -69225,13 +69410,15 @@ def _printShowTokens(entityType, users):
       if clientId:
         results = [callGAPI(cd.tokens(), 'get',
                             throwReasons=[GAPI.USER_NOT_FOUND, GAPI.DOMAIN_NOT_FOUND,
-                                          GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.FORBIDDEN, GAPI.BAD_REQUEST,
-                                          GAPI.NOT_FOUND, GAPI.RESOURCE_NOT_FOUND],
+                                          GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.BAD_REQUEST,
+                                          GAPI.NOT_FOUND, GAPI.RESOURCE_NOT_FOUND,
+                                          GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                             userKey=user, clientId=clientId, fields=fields)]
       else:
         results = callGAPIitems(cd.tokens(), 'list', 'items',
                                 throwReasons=[GAPI.USER_NOT_FOUND, GAPI.DOMAIN_NOT_FOUND,
-                                              GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.FORBIDDEN, GAPI.BAD_REQUEST],
+                                              GAPI.DOMAIN_CANNOT_USE_APIS, GAPI.BAD_REQUEST,
+                                              GAPI.FORBIDDEN, GAPI.PERMISSION_DENIED],
                                 userKey=user, fields=f'items({fields})')
       jcount = len(results)
       if not aggregateUsersBy:
@@ -69271,8 +69458,10 @@ def _printShowTokens(entityType, users):
         aggregateTokensById[user] = jcount
     except (GAPI.notFound, GAPI.resourceNotFound) as e:
       entityActionFailedWarning([Ent.USER, user, Ent.ACCESS_TOKEN, clientId], str(e), i, count)
-    except (GAPI.userNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden, GAPI.badRequest):
+    except (GAPI.userNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.badRequest):
       entityUnknownWarning(Ent.USER, user, i, count)
+    except (GAPI.forbidden, GAPI.permissionDenied) as e:
+      ClientAPIAccessDeniedExit(str(e))
   if aggregateUsersBy == 'clientId':
     if not csvPF:
       jcount = len(aggregateTokensById)
@@ -76487,6 +76676,7 @@ MAIN_COMMANDS_WITH_OBJECTS = {
       Cmd.ARG_USERINVITATION:	doCheckCIUserInvitations,
       Cmd.ARG_ISINVITABLE:	doCheckCIUserInvitations,
       Cmd.ARG_ORG:		doCheckOrgUnit,
+      Cmd.ARG_SUSPENDED:	doCheckUserSuspended,
      }
     ),
   'clear':