Getting "Domain cannot use apis" when using Google Admin SDK Directory API

Question

I'm trying to use the Admin SDK Directory API, specifically to retrieve user info as detailed by the Users: get endpoint.

I have requested the following permissions when oauthing

https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.user.readonly

However, when I make the request to get info on a particular user, I get the following response:

HTTP/1.1 403 Forbidden
Content-Type: application/json; charset=UTF-8
Date: Fri, 26 Jul 2013 18:25:29 GMT
Expires: Fri, 26 Jul 2013 18:25:29 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Transfer-Encoding: chunked

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "domainCannotUseApis",
    "message": "Domain cannot use apis."
   }
  ],
  "code": 403,
  "message": "Domain cannot use apis."
 }
}

I have enabled the Admin SDK in the API Console.

I have tried this on a Google Apps Standard (Free) Edition and also a Google Apps for Nonprofits Edition and get the same error. Does the Admin SDK Directory API require a Google Apps for Business Account?

Answer 1

You need to enable the administrative APIs in the G Suite Control Panel.

Answer 2

I am confused. Does it mean that if our App is listed in the Google Apps Marketplace, domains who install our App still have to manually enable the administrative API?