I use the provisioning and reports apis and I think both are deprecated... ack! Oh.. the successor is still in limited beta. https://developers.google.com/admin-sdk/
Accounts are generated and maintained by horrible php scripts in the home dir of the 'google' user on edison.
There is a tool to let instructors populate their google apps addr book with student google email addrs. It's not in the 'google' home dir. Where did that go..? Anyway, that one was written in perl and is much less crazy.