Reference
Workspace administration
Provisioning people, mailboxes, aliases and domains, plus the audit log. Separate permissions that only an administrator can put on a key.
Coming soon
This area is designed and its permissions are settled, but no endpoint in it is answering yet. It is listed here so you can see what the API will cover and choose permissions in the console that will still mean the same thing when it lands.
Permissions it will use
These are already in the catalog, so a key created today carrying one keeps working unchanged when the endpoints arrive.
admin.audit.read admin.billing.read admin.domains.read admin.users.read admin.users.write