rpc CreateRole(CreateRoleRequest) returns (Role)

Creates a new customRole.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc CreateServiceAccount(CreateServiceAccountRequest) returns (ServiceAccount)

Creates aServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc CreateServiceAccountKey(CreateServiceAccountKeyRequest) returns (ServiceAccountKey)

Creates aServiceAccountKey.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc DeleteRole(DeleteRoleRequest) returns (Role)

Deletes a customRole.

When you delete a custom role, the following changes occur immediately:

• You cannot bind a principal to the custom role in an IAMPolicy.
• Existing bindings to the custom role are not changed, but they have no effect.
• By default, the response fromListRoles does not include the custom role.

A deleted custom role still counts toward thecustom role limit until it is permanently deleted. You have 7 days to undelete the custom role. After 7 days, the following changes occur:

• The custom role is permanently deleted and cannot be recovered.
• If an IAM policy contains a binding to the custom role, the binding is permanently removed.
• The custom role no longer counts toward your custom role limit.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc DeleteServiceAccount(DeleteServiceAccountRequest) returns (Empty)

Deletes aServiceAccount.

Warning: After you delete a service account, you might not be able to undelete it. If you know that you need to re-enable the service account in the future, useDisableServiceAccount instead.

If you delete a service account, IAM permanently removes the service account 30 days later. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

To help avoid unplanned outages, we recommend that you disable the service account before you delete it. UseDisableServiceAccount to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc DeleteServiceAccountKey(DeleteServiceAccountKeyRequest) returns (Empty)

Deletes aServiceAccountKey. Deleting a service account key does not revoke short-lived credentials that have been issued based on the service account key.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc DisableServiceAccount(DisableServiceAccountRequest) returns (Empty)

Disables aServiceAccount immediately.

If an application uses the service account to authenticate, that application can no longer call Google APIs or access Google Cloud resources. Existing access tokens for the service account are rejected, and requests for new access tokens will fail.

To re-enable the service account, useEnableServiceAccount. After you re-enable the service account, its existing access tokens will be accepted, and you can request new access tokens.

To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use this method to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account withDeleteServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc DisableServiceAccountKey(DisableServiceAccountKeyRequest) returns (Empty)

Disable aServiceAccountKey. A disabled service account key can be re-enabled withEnableServiceAccountKey.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc EnableServiceAccount(EnableServiceAccountRequest) returns (Empty)

Enables aServiceAccount that was disabled byDisableServiceAccount.

If the service account is already enabled, then this method has no effect.

If the service account was disabled by other means—for example, if Google disabled the service account because it was compromised—you cannot use this method to enable the service account.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc EnableServiceAccountKey(EnableServiceAccountKeyRequest) returns (Empty)

Enable aServiceAccountKey.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc GetIamPolicy(GetIamPolicyRequest) returns (Policy)

Gets the IAM policy that is attached to aServiceAccount. This IAM policy specifies which principals have access to the service account.

This method does not tell you whether the service account has been granted any roles on other resources. To check whether a service account has role grants on a resource, use thegetIamPolicy method for that resource. For example, to view the role grants for a project, call the Resource Manager API'sprojects.getIamPolicy method.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc GetRole(GetRoleRequest) returns (Role)

Gets the definition of aRole.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc GetServiceAccount(GetServiceAccountRequest) returns (ServiceAccount)

Gets aServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc GetServiceAccountKey(GetServiceAccountKeyRequest) returns (ServiceAccountKey)

Gets aServiceAccountKey.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc LintPolicy(LintPolicyRequest) returns (LintPolicyResponse)

Lints, or validates, an IAM policy. Currently checks thegoogle.iam.v1.Binding.condition field, which contains a condition expression for a role binding.

Successful calls to this method always return an HTTP200 OK status code, even if the linter detects an issue in the IAM policy.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc ListRoles(ListRolesRequest) returns (ListRolesResponse)

Lists every predefinedRole that IAM supports, or every custom role that is defined for an organization or project.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc ListServiceAccountKeys(ListServiceAccountKeysRequest) returns (ListServiceAccountKeysResponse)

Lists everyServiceAccountKey for a service account.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc ListServiceAccounts(ListServiceAccountsRequest) returns (ListServiceAccountsResponse)

Lists everyServiceAccount that belongs to a specific project.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc PatchServiceAccount(PatchServiceAccountRequest) returns (ServiceAccount)

Patches aServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc QueryAuditableServices(QueryAuditableServicesRequest) returns (QueryAuditableServicesResponse)

Returns a list of services that allow you to opt into audit logs that are not generated by default.

To learn more about audit logs, see theLogging documentation.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc QueryGrantableRoles(QueryGrantableRolesRequest) returns (QueryGrantableRolesResponse)

Lists roles that can be granted on a Google Cloud resource. A role is grantable if the IAM policy for the resource can contain bindings to the role.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc QueryTestablePermissions(QueryTestablePermissionsRequest) returns (QueryTestablePermissionsResponse)

Lists every permission that you can test on a resource. A permission is testable if you can check whether a principal has that permission on the resource.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc SetIamPolicy(SetIamPolicyRequest) returns (Policy)

Sets the IAM policy that is attached to aServiceAccount.

Use this method to grant or revoke access to the service account. For example, you could grant a principal the ability to impersonate the service account.

This method does not enable the service account to access other resources. To grant roles to a service account on a resource, follow these steps:

1. Call the resource'sgetIamPolicy method to get its current IAM policy.
2. Edit the policy so that it binds the service account to an IAM role for the resource.
3. Call the resource'ssetIamPolicy method to update its IAM policy.

For detailed instructions, seeManage access to project, folders, and organizations orManage access to other resources.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

This method is deprecated. Use thesignBlob method in the IAM Service Account Credentials API instead. If you currently use this method, see themigration guide for instructions.

rpc SignBlob(SignBlobRequest) returns (SignBlobResponse)

Signs a blob using the system-managed private key for aServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

This method is deprecated. Use thesignJwt method in the IAM Service Account Credentials API instead. If you currently use this method, see themigration guide for instructions.

rpc SignJwt(SignJwtRequest) returns (SignJwtResponse)

Signs a JSON Web Token (JWT) using the system-managed private key for aServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc TestIamPermissions(TestIamPermissionsRequest) returns (TestIamPermissionsResponse)

Tests whether the caller has the specified permissions on aServiceAccount.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc UndeleteRole(UndeleteRoleRequest) returns (Role)

Undeletes a customRole.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc UndeleteServiceAccount(UndeleteServiceAccountRequest) returns (UndeleteServiceAccountResponse)

Restores a deletedServiceAccount.

Important: It is not always possible to restore a deleted service account. Use this method only as a last resort.

After you delete a service account, IAM permanently removes the service account 30 days later. There is no way to restore a deleted service account that has been permanently removed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc UpdateRole(UpdateRoleRequest) returns (Role)

Updates the definition of a customRole.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc UpdateServiceAccount(ServiceAccount) returns (ServiceAccount)

Note: We are in the process of deprecating this method. UsePatchServiceAccount instead.

Updates aServiceAccount.

You can update only thedisplay_name field.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc UploadServiceAccountKey(UploadServiceAccountKeyRequest) returns (ServiceAccountKey)

Uploads the public key portion of a key pair that you manage, and associates the public key with aServiceAccount.

After you upload the public key, you can use the private key from the key pair as a service account key.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/iam
• https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

rpc CreateOauthClient(CreateOauthClientRequest) returns (OauthClient)

Creates a newOauthClient.

You cannot reuse the name of a deletedOauthClient until 30 days after deletion.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc CreateOauthClientCredential(CreateOauthClientCredentialRequest) returns (OauthClientCredential)

Creates a newOauthClientCredential.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteOauthClient(DeleteOauthClientRequest) returns (OauthClient)

Deletes anOauthClient.

You cannot use a deletedOauthClient. However, deletion does not revoke access tokens that have already been issued. They continue to grant access. Deletion does revoke refresh tokens that have already been issued. They cannot be used to renew an access token. If theOauthClient is undeleted, and the refresh tokens are not expired, they are valid for token exchange again. You can undelete anOauthClient for 30 days. After 30 days, deletion is permanent. You cannot update deletedOauthClients. However, you can view and list them.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteOauthClientCredential(DeleteOauthClientCredentialRequest) returns (Empty)

Deletes anOauthClientCredential.

Before deleting anOauthClientCredential, it should first be disabled.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetOauthClient(GetOauthClientRequest) returns (OauthClient)

Gets an individualOauthClient.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetOauthClientCredential(GetOauthClientCredentialRequest) returns (OauthClientCredential)

Gets an individualOauthClientCredential.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListOauthClientCredentials(ListOauthClientCredentialsRequest) returns (ListOauthClientCredentialsResponse)

Lists allOauthClientCredentials in anOauthClient.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListOauthClients(ListOauthClientsRequest) returns (ListOauthClientsResponse)

Lists all non-deletedOauthClients in a project. Ifshow_deleted is set totrue, then deletedOauthClients are also listed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteOauthClient(UndeleteOauthClientRequest) returns (OauthClient)

Undeletes anOauthClient, as long as it was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UpdateOauthClient(UpdateOauthClientRequest) returns (OauthClient)

Updates an existingOauthClient.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UpdateOauthClientCredential(UpdateOauthClientCredentialRequest) returns (OauthClientCredential)

Updates an existingOauthClientCredential.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc CreateWorkforcePool(CreateWorkforcePoolRequest) returns (Operation)

Creates a newWorkforcePool.

You cannot reuse the name of a deleted pool until 30 days after deletion.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc CreateWorkforcePoolProvider(CreateWorkforcePoolProviderRequest) returns (Operation)

Creates a newWorkforcePoolProvider in aWorkforcePool.

You cannot reuse the name of a deleted provider until 30 days after deletion.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc CreateWorkforcePoolProviderKey(CreateWorkforcePoolProviderKeyRequest) returns (Operation)

Creates a newWorkforcePoolProviderKey in aWorkforcePoolProvider.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc CreateWorkforcePoolProviderScimTenant(CreateWorkforcePoolProviderScimTenantRequest) returns (WorkforcePoolProviderScimTenant)

Gemini Enterprise only. Creates a newWorkforcePoolProviderScimTenant in aWorkforcePoolProvider. You cannot reuse the name of a deleted SCIM tenant until 30 days after deletion.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc CreateWorkforcePoolProviderScimToken(CreateWorkforcePoolProviderScimTokenRequest) returns (WorkforcePoolProviderScimToken)

Gemini Enterprise only. Creates a newWorkforcePoolProviderScimToken in aWorkforcePoolProviderScimTenant. You cannot reuse the name of a deleted SCIM token until 30 days after deletion.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteWorkforcePool(DeleteWorkforcePoolRequest) returns (Operation)

Deletes aWorkforcePool.

You cannot use a deleted WorkforcePool to exchange external credentials for Google Cloud credentials. However, deletion does not revoke credentials that have already been issued. Credentials issued for a deleted pool do not grant access to resources. If the pool is undeleted, and the credentials are not expired, they grant access again. You can undelete a pool for 30 days. After 30 days, deletion is permanent. You cannot update deleted pools. However, you can view and list them.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteWorkforcePoolProvider(DeleteWorkforcePoolProviderRequest) returns (Operation)

Deletes aWorkforcePoolProvider.

Deleting a provider does not revoke credentials that have already been issued; they continue to grant access. You can undelete a provider for 30 days. After 30 days, deletion is permanent. You cannot update deleted providers. However, you can view and list them.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteWorkforcePoolProviderKey(DeleteWorkforcePoolProviderKeyRequest) returns (Operation)

Deletes aWorkforcePoolProviderKey. You can undelete a key for 30 days. After 30 days, deletion is permanent.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteWorkforcePoolProviderScimTenant(DeleteWorkforcePoolProviderScimTenantRequest) returns (WorkforcePoolProviderScimTenant)

Gemini Enterprise only. Deletes aWorkforcePoolProviderScimTenant.

You can undelete a SCIM tenant for 30 days. After 30 days, deletion is permanent. You cannot update deleted SCIM tenants. However, you can view and list them.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteWorkforcePoolProviderScimToken(DeleteWorkforcePoolProviderScimTokenRequest) returns (WorkforcePoolProviderScimToken)

Gemini Enterprise only. Deletes aWorkforcePoolProviderScimToken. You can undelete a SCIM token for 30 days. After 30 days, the SCIM token is permanently deleted. You cannot update deleted SCIM tokens, however, you can view and list them.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc DeleteWorkforcePoolSubject(DeleteWorkforcePoolSubjectRequest) returns (Operation)

Deletes aWorkforcePoolSubject.

Subject must not already be in a deleted state.

AWorkforcePoolSubject is automatically created the first time an external credential is exchanged for a Google Cloud credential using a mappedgoogle.subject attribute. There is no endpoint to manually create aWorkforcePoolSubject.

For 30 days after aWorkforcePoolSubject is deleted, using the samegoogle.subject attribute in token exchanges with Google Cloud STS fails.

CallUndeleteWorkforcePoolSubject to undelete aWorkforcePoolSubject that has been deleted, within within 30 days of deleting it.

After 30 days, theWorkforcePoolSubject is permanently deleted. At this point, a token exchange with Google Cloud STS that uses the same mappedgoogle.subject attribute automatically creates a newWorkforcePoolSubject that is unrelated to the previously deletedWorkforcePoolSubject but has the samegoogle.subject value.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetIamPolicy(GetIamPolicyRequest) returns (Policy)

Gets IAM policies on aWorkforcePool.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetWorkforcePool(GetWorkforcePoolRequest) returns (WorkforcePool)

Gets an individualWorkforcePool.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetWorkforcePoolProvider(GetWorkforcePoolProviderRequest) returns (WorkforcePoolProvider)

Gets an individualWorkforcePoolProvider.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetWorkforcePoolProviderKey(GetWorkforcePoolProviderKeyRequest) returns (WorkforcePoolProviderKey)

Gets aWorkforcePoolProviderKey.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetWorkforcePoolProviderScimTenant(GetWorkforcePoolProviderScimTenantRequest) returns (WorkforcePoolProviderScimTenant)

Gemini Enterprise only. Gets an individualWorkforcePoolProviderScimTenant.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc GetWorkforcePoolProviderScimToken(GetWorkforcePoolProviderScimTokenRequest) returns (WorkforcePoolProviderScimToken)

Gemini Enterprise only. Gets an individualWorkforcePoolProviderScimToken.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListWorkforcePoolProviderKeys(ListWorkforcePoolProviderKeysRequest) returns (ListWorkforcePoolProviderKeysResponse)

Lists all non-deletedWorkforcePoolProviderKeys in aWorkforcePoolProvider. Ifshow_deleted is set totrue, then deleted keys are also listed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListWorkforcePoolProviderScimTenants(ListWorkforcePoolProviderScimTenantsRequest) returns (ListWorkforcePoolProviderScimTenantsResponse)

Gemini Enterprise only. Lists all non-deletedWorkforcePoolProviderScimTenants in aWorkforcePoolProvider. Ifshow_deleted is set totrue, then deleted SCIM tenants are also listed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListWorkforcePoolProviderScimTokens(ListWorkforcePoolProviderScimTokensRequest) returns (ListWorkforcePoolProviderScimTokensResponse)

Gemini Enterprise only. Lists all non-deleted [WorkforcePoolProviderScimTokens][]s in aWorkforcePoolProviderScimTenant. Ifshow_deleted is set totrue, then deleted SCIM tokens are also listed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListWorkforcePoolProviders(ListWorkforcePoolProvidersRequest) returns (ListWorkforcePoolProvidersResponse)

Lists all non-deletedWorkforcePoolProviders in aWorkforcePool. Ifshow_deleted is set totrue, then deleted providers are also listed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc ListWorkforcePools(ListWorkforcePoolsRequest) returns (ListWorkforcePoolsResponse)

Lists all non-deletedWorkforcePools under the specified parent. Ifshow_deleted is set totrue, then deleted pools are also listed.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc SetIamPolicy(SetIamPolicyRequest) returns (Policy)

Sets IAM policies on aWorkforcePool.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc TestIamPermissions(TestIamPermissionsRequest) returns (TestIamPermissionsResponse)

Returns the caller's permissions on theWorkforcePool. If the pool doesn't exist, this call returns an empty set of permissions. It doesn't return aNOT_FOUND error.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteWorkforcePool(UndeleteWorkforcePoolRequest) returns (Operation)

Undeletes aWorkforcePool, as long as it was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteWorkforcePoolProvider(UndeleteWorkforcePoolProviderRequest) returns (Operation)

Undeletes aWorkforcePoolProvider, as long as it was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteWorkforcePoolProviderKey(UndeleteWorkforcePoolProviderKeyRequest) returns (Operation)

Undeletes aWorkforcePoolProviderKey, as long as it was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteWorkforcePoolProviderScimTenant(UndeleteWorkforcePoolProviderScimTenantRequest) returns (WorkforcePoolProviderScimTenant)

Gemini Enterprise only. Undeletes aWorkforcePoolProviderScimTenant, that was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteWorkforcePoolProviderScimToken(UndeleteWorkforcePoolProviderScimTokenRequest) returns (WorkforcePoolProviderScimToken)

Gemini Enterprise only. Undeletes aWorkforcePoolProviderScimToken,that was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UndeleteWorkforcePoolSubject(UndeleteWorkforcePoolSubjectRequest) returns (Operation)

Undeletes aWorkforcePoolSubject, as long as it was deleted fewer than 30 days ago.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UpdateWorkforcePool(UpdateWorkforcePoolRequest) returns (Operation)

Updates an existingWorkforcePool.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UpdateWorkforcePoolProvider(UpdateWorkforcePoolProviderRequest) returns (Operation)

Updates an existingWorkforcePoolProvider.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UpdateWorkforcePoolProviderScimTenant(UpdateWorkforcePoolProviderScimTenantRequest) returns (WorkforcePoolProviderScimTenant)

Gemini Enterprise only. Updates an existingWorkforcePoolProviderScimTenant.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

rpc UpdateWorkforcePoolProviderScimToken(UpdateWorkforcePoolProviderScimTokenRequest) returns (WorkforcePoolProviderScimToken)

Gemini Enterprise only. Updates an existingWorkforcePoolProviderScimToken.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/iam

For more information, see theAuthentication Overview.

PermissionDelta

The permission_delta when when creating or updating a Role.

string

Added permissions.

string

Removed permissions.

string

Required. The parent resource to create theOauthClientCredential in.

OauthClientCredential

Required. TheOauthClientCredential to create.

string

Required. The ID to use for theOauthClientCredential, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefixgcp- is reserved for use by Google, and may not be specified.

string

Required. The parent resource to create theOauthClient in. The only supported location isglobal.

OauthClient

Required. TheOauthClient to create.

string

Required. The ID to use for theOauthClient, which becomes the final component of the resource name. This value should be a string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefixgcp- is reserved for use by Google, and may not be specified.

string

Theparent parameter's value depends on the target resource for the request, namelyprojects ororganizations. Each resource type'sparent value format is described below:

• projects.roles.create:projects/{PROJECT_ID}. This method creates project-levelcustom roles. Example request URL:https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles

• organizations.roles.create:organizations/{ORGANIZATION_ID}. This method creates organization-levelcustom roles. Example request URL:https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles

Note: Wildcard (*) values are invalid; you must specify a complete project ID or organization ID.

Authorization requires the followingIAM permission on the specified resourceparent:

• iam.roles.create

string

The role ID to use for this role.

A role ID may contain alphanumeric characters, underscores (_), and periods (.). It must contain a minimum of 3 characters and a maximum of 64 characters.

Role

The Role resource to create.

string

Required. The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.create

ServiceAccountPrivateKeyType

The output format of the private key. The default value isTYPE_GOOGLE_CREDENTIALS_FILE, which is the Google Credentials File format.

ServiceAccountKeyAlgorithm

Which type of key and algorithm to use for the key. The default is currently a 2K RSA key. However this may change in the future.

string

Required. The resource name of the project associated with the service accounts, such asprojects/my-project-123.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.create

string

Required. The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression[a-z]([-a-z0-9]*[a-z0-9]) to comply with RFC1035.

ServiceAccount

TheServiceAccount resource to create. Currently, only the following values are user assignable:display_name anddescription.

string

Required. The provider to create this key in.

WorkforcePoolProviderKey

Required. The WorkforcePoolProviderKey to create.

string

Required. The ID to use for the key, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].

string

Required. The pool to create this provider in.

Format:locations/{location}/workforcePools/{workforce_pool_id}

WorkforcePoolProvider

Required. The provider to create.

string

Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefixgcp- is reserved for use by Google, and may not be specified.

string

Required. Gemini Enterprise only. The parent to create SCIM tenant. Format: 'locations/{location}/workforcePools/{workforce_pool}/providers/{provider}'

WorkforcePoolProviderScimTenant

Required. Gemini Enterprise only. The SCIM tenant to create.

string

Required. Gemini Enterprise only. The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value should be 4-32 characters, containing the characters [a-z0-9-].

string

Required. Gemini Enterprise only. The parent tenant to create SCIM token. Format: 'locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}'

WorkforcePoolProviderScimToken

Required. Gemini Enterprise only. The SCIM token to create.

string

Required. Gemini Enterprise only. The ID to use for the SCIM token, which becomes the final component of the resource name. This value should be 4-32 characters and follow the pattern: "(a-z)"

WorkforcePool

Required. The pool to create.

string

Optional. The location of the pool to create.

Format:locations/{location}.

string

Optional. The ID to use for the pool, which becomes the final component of the resource name. The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefixgcp- is reserved for use by Google, and may not be specified.

string

Required. The name of theOauthClientCredential to delete.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}/credentials/{credential}.

string

Required. The name of theOauthClient to delete.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}.

string

Thename parameter's value depends on the target resource for the request, namelyprojects ororganizations. Each resource type'sname value format is described below:

• projects.roles.delete:projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. This method deletes onlycustom roles that have been created at the project level. Example request URL:https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}

• organizations.roles.delete:organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}. This method deletes onlycustom roles that have been created at the organization level. Example request URL:https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}

Note: Wildcard (*) values are invalid; you must specify a complete project ID or organization ID.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.roles.delete

bytes

Used to perform a consistent read-modify-write.

string

Required. The resource name of the service account key.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/-/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service account keyprojects/-/serviceAccounts/fake@example.com/keys/fake-key, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.delete

string

Required. The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.delete

string

Required. The name of the key to delete.

string

Required. The name of the provider to delete.

Format:locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}

string

Required. Gemini Enterprise only. The name of the SCIM tenant to delete.

Format:locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}

bool

Optional. Deletes the SCIM tenant immediately. This operation cannot be undone.

string

Required. Gemini Enterprise only. The name of the SCIM token to delete.

Format:locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}/tokens/{token}

string

Required. The name of the pool to delete.

Format:locations/{location}/workforcePools/{workforce_pool_id}

string

Required. The resource name of theWorkforcePoolSubject. Special characters, like/ and:, must be escaped, because all URLs need to conform to the "When to Escape and Unescape" section ofRFC3986.

Format:locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}

string

Required. The resource name of the service account key.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/-/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service account keyprojects/-/serviceAccounts/fake@example.com/keys/fake-key, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.disable

ServiceAccountKeyDisableReason

Optional. Describes the reason this key is being disabled. If unspecified, the default value of SERVICE_ACCOUNT_KEY_DISABLE_REASON_USER_INITIATED will be used.

string

Optional. Usable by internal google services only. An extended_status_message can be used to include additional information about the key, such as its private key data being exposed on a public repository like GitHub.

string

The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.disable

string

Required. The resource name of the service account key.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/-/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service account keyprojects/-/serviceAccounts/fake@example.com/keys/fake-key, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.enable

string

The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.enable

string

Required. The name of theOauthClientCredential to retrieve.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}/credentials/{credential}.

string

Required. The name of theOauthClient to retrieve.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}.

string

Thename parameter's value depends on the target resource for the request, namelyroles,projects, ororganizations. Each resource type'sname value format is described below:

• roles.get:roles/{ROLE_NAME}. This method returns results from allpredefined roles in IAM. Example request URL:https://iam.googleapis.com/v1/roles/{ROLE_NAME}

• projects.roles.get:projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. This method returns onlycustom roles that have been created at the project level. Example request URL:https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}

• organizations.roles.get:organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}. This method returns onlycustom roles that have been created at the organization level. Example request URL:https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}

Note: Wildcard (*) values are invalid; you must specify a complete project ID or organization ID.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.roles.get

string

Required. The resource name of the service account key.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}/keys/{KEY_ID}
• projects/-/serviceAccounts/{UNIQUE_ID}/keys/{KEY_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service account keyprojects/-/serviceAccounts/fake@example.com/keys/fake-key, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.get

ServiceAccountPublicKeyType

Optional. The output format of the public key. The default isTYPE_NONE, which means that the public key is not returned.

string

Required. The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.get

string

Required. The name of the key to retrieve.

string

Required. The name of the provider to retrieve.

Format:locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}

string

Required. Gemini Enterprise only. The name of the SCIM tenant to retrieve.

Format:locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}

string

Required. Gemini Enterprise only. The name of the SCIM token to retrieve.

Format:locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}/tokens/{token}

string

Required. The name of the pool to retrieve.

Format:locations/{location}/workforcePools/{workforce_pool_id}

KeyFormat

Output only. The format of the key.

Timestamp

Output only. Earliest timestamp when this key is valid. Attempts to use this key before this time will fail. Only present if the key data represents a X.509 certificate.

Timestamp

Output only. Latest timestamp when this key is valid. Attempts to use this key after this time will fail. Only present if the key data represents a X.509 certificate.

string

Output only. The key data. The format of the key is represented by theformat field.

KeySpec

Required. The specifications for the key.

string

The full resource name of the policy this lint request is about.

The name follows the Google Cloud format for full resource names. For example, a Google Cloud project with IDmy-project will be named//cloudresourcemanager.googleapis.com/projects/my-project.

The resource name is not used to read a policy from IAM. Only the data in the request object is linted.

Expr

google.iam.v1.Binding.condition object to be linted.

LintResult

List of lint results sorted byseverity in descending order.

Level

The validation unit level.

string

The validation unit name, for instance "lintValidationUnits/ConditionComplexityCheck".

Severity

The validation unit severity.

string

The name of the field for which this lint result is about.

For nested messagesfield_name consists of names of the embedded fields separated by period character. The top-level qualifier is the input object to lint in the request. For example, thefield_name valuecondition.expression identifies a lint result for theexpression field of the provided condition.

int32

0-based character position of problematic construct within the object identified byfield_name. Currently, this is populated only for condition expression.

string

Human readable debug message associated with the issue.

Any issue which is severe enough but does not cause an error. For example, suspicious constructs in the input object will not necessarily failsetPolicy, but there is a high likelihood that they won't behave as expected during policy evaluation incheckPolicy. This includes the following common scenarios:

• Unsatisfiable condition: Expired timestamp in date/time condition.
• Ineffective condition: Condition on a <principal, role> pair which is granted unconditionally in another binding of the same policy.

string

Required. The parent to listOauthClientCredentials for.

OauthClientCredential

A list ofOauthClientCredentials.

string

Required. The parent to listOauthClients for.

int32

Optional. The maximum number ofOauthClients to return. If unspecified, at most 50OauthClients will be returned. The maximum value is 100; values above 100 are truncated to 100.

string

Optional. A page token, received from a previousListOauthClients call. Provide this to retrieve the subsequent page.

bool

Optional. Whether to return soft-deletedOauthClients.

OauthClient

A list ofOauthClients.

string

Optional. A token, which can be sent aspage_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

string

Theparent parameter's value depends on the target resource for the request, namelyroles,projects, ororganizations. Each resource type'sparent value format is described below:

• roles.list: An empty string. This method doesn't require a resource; it simply returns allpredefined roles in IAM. Example request URL:https://iam.googleapis.com/v1/roles

• projects.roles.list:projects/{PROJECT_ID}. This method lists all project-levelcustom roles. Example request URL:https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles

• organizations.roles.list:organizations/{ORGANIZATION_ID}. This method lists all organization-levelcustom roles. Example request URL:https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles

Note: Wildcard (*) values are invalid; you must specify a complete project ID or organization ID.

Authorization requires the followingIAM permission on the specified resourceparent:

• iam.roles.list

int32

Optional limit on the number of roles to include in the response.

The default is 300, and the maximum is 1,000.

string

Optional pagination token returned in an earlier ListRolesResponse.

RoleView

Optional view for the returned Role objects. WhenFULL is specified, theincludedPermissions field is returned, which includes a list of all permissions in the role. The default value isBASIC, which does not return theincludedPermissions field.

bool

Include Roles that have been deleted.

Role

The Roles defined on this resource.

string

To retrieve the next page of results, setListRolesRequest.page_token to this value.

string

Required. The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.list

KeyType

Filters the types of keys the user wants to include in the list response. Duplicate key types are not allowed. If no key type is provided, all keys are returned.

ServiceAccountKey

The public keys for the service account.

string

Required. The resource name of the project associated with the service accounts, such asprojects/my-project-123.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.list

int32

Optional limit on the number of service accounts to include in the response. Further accounts can subsequently be obtained by including theListServiceAccountsResponse.next_page_token in a subsequent request.

The default is 20, and the maximum is 100.

string

Optional pagination token returned in an earlierListServiceAccountsResponse.next_page_token.

ServiceAccount

The list of matching service accounts.

string

To retrieve the next page of results, setListServiceAccountsRequest.page_token to this value.

string

Required. The provider resource to list encryption keys for.

Format:locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}

int32

The maximum number of keys to return. If unspecified, all keys are returned. The maximum value is 10; values above 10 are truncated to 10.

string

A page token, received from a previousListWorkforcePoolProviderKeys call. Provide this to retrieve the subsequent page.

bool

Whether to return soft-deleted keys.

WorkforcePoolProviderKey

A list of WorkforcePoolProviderKeys.

string

A token, which can be sent aspage_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

string

Required. Gemini Enterprise only. The parent to list SCIM tenants. Format: 'locations/{location}/workforcePools/{workforce_pool}/providers/{provider}'

int32

Optional. Gemini Enterprise only. The maximum number of SCIM tenants to return. If unspecified, at most 50 SCIM tenants will be returned. The maximum value is 100; values above 100 are truncated to 100.

string

Optional. Gemini Enterprise only. A page token, received from a previousListScimTenants call. Provide this to retrieve the subsequent page.

bool

Optional. Gemini Enterprise only. Whether to return soft-deleted SCIM tenants.

WorkforcePoolProviderScimTenant

Output only. Gemini Enterprise only. A list of SCIM tenants.

string

Optional. Gemini Enterprise only. A token, which can be sent aspage_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

string

Required. Gemini Enterprise only. The parent to list SCIM tokens. Format: 'locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}'

int32

Optional. Gemini Enterprise only. The maximum number of SCIM tokens to return. If unspecified, at most 2 SCIM tokens will be returned.

string

Optional. Gemini Enterprise only. A page token, received from a previousListWorkforcePoolProviderScimTokens call. Provide this to retrieve the subsequent page.

bool

Optional. Gemini Enterprise only. Whether to return soft-deleted SCIM tokens.

WorkforcePoolProviderScimToken

Output only. Gemini Enterprise only. A list of SCIM tokens.

string

Optional. Gemini Enterprise only. A token, which can be sent aspage_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

string

Required. The pool to list providers for.

Format:locations/{location}/workforcePools/{workforce_pool_id}

int32

The maximum number of providers to return. If unspecified, at most 50 providers are returned. The maximum value is 100; values above 100 are truncated to 100.

string

A page token, received from a previousListWorkforcePoolProviders call. Provide this to retrieve the subsequent page.

bool

Whether to return soft-deleted providers.

WorkforcePoolProvider

A list of providers.

string

A token, which can be sent aspage_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

string

Required. The parent resource to list pools for.

Format:organizations/{org-id}.

int32

The maximum number of pools to return. The default value is 50. The maximum value is 100.

string

A page token, received from a previousListWorkforcePools call. Provide this to retrieve the subsequent page.

bool

Whether to return soft-deleted pools.

string

The location of the pool.

Format:locations/{location}.

WorkforcePool

A list of pools.

string

A token, which can be sent aspage_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

string

Immutable. Identifier. The resource name of theOauthClient.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}.

State

Output only. The state of theOauthClient.

bool

Optional. Whether theOauthClient is disabled. You cannot use a disabled OAuth client.

string

Output only. The system-generatedOauthClient id.

string

Optional. A user-specified display name of theOauthClient.

Cannot exceed 32 characters.

string

Optional. A user-specified description of theOauthClient.

Cannot exceed 256 characters.

ClientType

Immutable. The type ofOauthClient. Either public or private. For private clients, the client secret can be managed using the dedicatedOauthClientCredential resource.

GrantType

Required. The list of OAuth grant types is allowed for theOauthClient.

string

Required. The list of scopes that theOauthClient is allowed to request during OAuth flows.

The following scopes are supported:

• https://www.googleapis.com/auth/cloud-platform: See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account.

string

Required. The list of redirect uris that is allowed to redirect back when authorization process is completed.

Timestamp

Output only. Time after which theOauthClient will be permanently purged and cannot be recovered.

string

Immutable. Identifier. The resource name of theOauthClientCredential.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}/credentials/{credential}

bool

Optional. Whether theOauthClientCredential is disabled. You cannot use a disabledOauthClientCredential.

string

Optional. A user-specified display name of theOauthClientCredential.

Cannot exceed 32 characters.

Union fieldcredential.

credential can be only one of the following:

string

Output only. The system-generated OAuth client secret.

The client secret must be stored securely. If the client secret is leaked, you must delete and re-create the client credential. To learn more, seeOAuth client and credential security risks and mitigations

ServiceAccount

Authorization requires the followingIAM permission on the specified resourceserviceAccount:

• iam.serviceAccounts.update

FieldMask

string

The name of this Permission.

string

The title of this Permission.

string

A brief description of what this Permission is used for.

bool

PermissionLaunchStage

The current launch stage of the permission.

CustomRolesSupportLevel

The current custom role support level.

bool

The service API associated with the permission is not enabled.

string

The preferred name for this permission. If present, then this permission is an alias of, and equivalent to, the listed primary_permission.

string

Required. The full resource name to query from the list of auditable services.

The name follows the Google Cloud Platform resource format. For example, a Cloud Platform project with idmy-project will be named//cloudresourcemanager.googleapis.com/projects/my-project.

AuditableService

The auditable services for a resource.

string

Public name of the service. For example, the service name for IAM is 'iam.googleapis.com'.

string

Required. Required. The full resource name to query from the list of grantable roles.

The name follows the Google Cloud Platform resource format. For example, a Cloud Platform project with idmy-project will be named//cloudresourcemanager.googleapis.com/projects/my-project.

RoleView

int32

Optional limit on the number of roles to include in the response.

The default is 300, and the maximum is 2,000.

string

Optional pagination token returned in an earlier QueryGrantableRolesResponse.

Role

The list of matching roles.

string

To retrieve the next page of results, setQueryGrantableRolesRequest.page_token to this value.

string

Required. The full resource name to query from the list of testable permissions.

The name follows the Google Cloud Platform resource format. For example, a Cloud Platform project with idmy-project will be named//cloudresourcemanager.googleapis.com/projects/my-project.

int32

Optional limit on the number of permissions to include in the response.

The default is 100, and the maximum is 1,000.

string

Optional pagination token returned in an earlier QueryTestablePermissionsRequest.

Permission

The Permissions testable on the requested resource.

string

To retrieve the next page of results, setQueryTestableRolesRequest.page_token to this value.

string

The name of the role.

WhenRole is used inCreateRole, the role name must not be set.

WhenRole is used in output and other input such asUpdateRole, the role name is the complete path. For example,roles/logging.viewer for predefined roles,organizations/{ORGANIZATION_ID}/roles/myRole for organization-level custom roles, andprojects/{PROJECT_ID}/roles/myRole for project-level custom roles.

string

Optional. A human-readable title for the role. Typically this is limited to 100 UTF-8 bytes.

string

Optional. A human-readable description for the role.

string

The names of the permissions this role grants when bound in an IAM policy.

RoleLaunchStage

The current launch stage of the role. If theALPHA launch stage has been selected for a role, thestage field will not be included in the returned definition for the role.

bytes

Used to perform a consistent read-modify-write.

bool

The current deleted state of the role. This field is read only. It will be ignored in calls to CreateRole and UpdateRole.

string

The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

string

Output only. The ID of the project that owns the service account.

string

Output only. The unique, stable numeric ID for the service account.

Each service account retains its unique ID even if you delete the service account. For example, if you delete a service account, then create a new service account with the same name, the new service account has a different unique ID than the deleted service account.

string

Output only. The email address of the service account.

string

Optional. A user-specified, human-readable name for the service account. The maximum length is 100 UTF-8 bytes.

bytes

string

Optional. A user-specified, human-readable description of the service account. The maximum length is 256 UTF-8 bytes.

string

Output only. The OAuth 2.0 client ID for the service account.

bool

Output only. Whether the service account is disabled.

string

The resource name of the service account key in the following formatprojects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}.

ServiceAccountPrivateKeyType

The output format for the private key. Only provided inCreateServiceAccountKey responses, not inGetServiceAccountKey orListServiceAccountKey responses.

Google never exposes system-managed private keys, and never retains user-managed private keys.

ServiceAccountKeyAlgorithm

Specifies the algorithm (and possibly key size) for the key.

bytes

The private key data. Only provided inCreateServiceAccountKey responses. Make sure to keep the private key data secure because it allows for the assertion of the service account identity. When base64 decoded, the private key data can be used to authenticate with Google API client libraries and withgcloud auth activate-service-account.

bytes

The public key data. Only provided inGetServiceAccountKey responses.

Timestamp

The key can be used after this timestamp.

Timestamp

The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.

ServiceAccountKeyOrigin

The key origin.

KeyType

The key type.

bool

The key status.

ServiceAccountKeyDisableReason

Output only. optional. If the key is disabled, it may have a DisableReason describing why it was disabled.

ExtendedStatus

Output only. Extended Status provides permanent information about a service account key. For example, if this key was detected as exposed or compromised, that information will remain for the lifetime of the key in the extended_status.

ServiceAccountKeyExtendedStatusKey

The key for this extended status.

string

The value for the extended status.

string

Required. Deprecated.Migrate to Service Account Credentials API.

The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.signBlob

bytes

Required. Deprecated.Migrate to Service Account Credentials API.

The bytes to sign.

string

Deprecated.Migrate to Service Account Credentials API.

The id of the key used to sign the blob.

bytes

Deprecated.Migrate to Service Account Credentials API.

The signed blob.

string

Required. Deprecated.Migrate to Service Account Credentials API.

The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.signJwt

string

Required. Deprecated.Migrate to Service Account Credentials API.

The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example:{"sub": "user@example.com", "iat": 313435}

If the JWT Claims Set contains an expiration time (exp) claim, it must be an integer timestamp that is not in the past and no more than 12 hours in the future.

If the JWT Claims Set does not contain an expiration time (exp) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.

string

Deprecated.Migrate to Service Account Credentials API.

The id of the key used to sign the JWT.

string

Deprecated.Migrate to Service Account Credentials API.

The signed JWT.

string

Required. The name of theOauthClient to undelete.

Format:projects/{project}/locations/{location}/oauthClients/{oauth_client}.

string

Thename parameter's value depends on the target resource for the request, namelyprojects ororganizations. Each resource type'sname value format is described below:

• projects.roles.undelete:projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. This method undeletes onlycustom roles that have been created at the project level. Example request URL:https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}

• organizations.roles.undelete:organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}. This method undeletes onlycustom roles that have been created at the organization level. Example request URL:https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}

Note: Wildcard (*) values are invalid; you must specify a complete project ID or organization ID.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.roles.undelete

bytes

Used to perform a consistent read-modify-write.

string

The resource name of the service account.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccounts.undelete

ServiceAccount

Metadata for the restored service account.

string

Required. The name of the key to undelete.

string

Required. The name of the provider to undelete.

Format:locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}

string

Required. Gemini Enterprise only. The name of the SCIM tenant to undelete.

Format:locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}

string

Required. Gemini Enterprise only. The name of the SCIM token to undelete.

Format:locations/{location}/workforcePools/{workforce_pool}/providers/{provider}/scimTenants/{scim_tenant}/tokens/{token}

string

Required. The name of the pool to undelete.

Format:locations/{location}/workforcePools/{workforce_pool_id}

string

Required. The resource name of theWorkforcePoolSubject. Special characters, like/ and:, must be escaped, because all URLs need to conform to the "When to Escape and Unescape" section ofRFC3986.

Format:locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}

OauthClientCredential

Required. TheOauthClientCredential to update. Thename field is used to identify theOauthClientCredential.

FieldMask

Required. The list of fields to update.

OauthClient

Required. TheOauthClient to update. Thename field is used to identify theOauthClient.

FieldMask

Required. The list of fields to update.

string

Thename parameter's value depends on the target resource for the request, namelyprojects ororganizations. Each resource type'sname value format is described below:

• projects.roles.patch:projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. This method updates onlycustom roles that have been created at the project level. Example request URL:https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}

• organizations.roles.patch:organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}. This method updates onlycustom roles that have been created at the organization level. Example request URL:https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}

Note: Wildcard (*) values are invalid; you must specify a complete project ID or organization ID.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.roles.update

Role

The updated role.

FieldMask

A mask describing which fields in the Role have changed.

WorkforcePoolProvider

Required. The provider to update.

FieldMask

Required. The list of fields to update.

WorkforcePoolProviderScimTenant

Required. Gemini Enterprise only. The SCIM tenant to update. Thename field is used to identify the SCIM tenant.

FieldMask

Optional. Gemini Enterprise only. The list of fields to update.

WorkforcePoolProviderScimToken

Required. Gemini Enterprise only. The SCIM token to update. Thename field is used to identify the SCIM token.

FieldMask

Optional. Gemini Enterprise only. The list of fields to update.

WorkforcePool

Required. The pool to update. Thename field is used to identify the pool.

FieldMask

Required. The list of fields to update.

string

The resource name of the service account key.

Use one of the following formats:

• projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}
• projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}

As an alternative, you can use the- wildcard character instead of the project ID:

• projects/-/serviceAccounts/{EMAIL_ADDRESS}
• projects/-/serviceAccounts/{UNIQUE_ID}

When possible, avoid using the- wildcard character, because it can cause response messages to contain misleading error codes. For example, if you try to access the service accountprojects/-/serviceAccounts/fake@example.com, which does not exist, the response contains an HTTP403 Forbidden error instead of a404 Not Found error.

Authorization requires the followingIAM permission on the specified resourcename:

• iam.serviceAccountKeys.create

bytes

The public key to associate with the service account. Must be an RSA public key that is wrapped in an X.509 v3 certificate. Include the first line,-----BEGIN CERTIFICATE-----, and the last line,-----END CERTIFICATE-----.

string

Identifier. The resource name of the pool.

Format:locations/{location}/workforcePools/{workforce_pool_id}

string

Immutable. The resource name of the parent.

Format:organizations/{org-id}.

string

Optional. A display name for the pool.

Cannot exceed 32 characters.

string

Optional. A description of the pool.

Cannot exceed 256 characters.

State

Output only. The state of the pool.

bool

Optional. Disables the workforce pool. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.

Duration

Optional. Duration that the Google Cloud access tokens, console sign-in sessions, andgcloud sign-in sessions from this pool are valid.

Must be greater than 15 minutes (900s) and less than 12 hours (43200s). Ifsession_duration is not configured, minted credentials have a default duration of one hour (3600s).

For SAML providers, the lifetime of the token is the minimum of thesession_duration and theSessionNotOnOrAfter claim in the SAML assertion.

Timestamp

Output only. Time after which the workforce pool will be permanently purged and cannot be recovered.

AccessRestrictions

Optional. Configure access restrictions on the workforce pool users. This is an optional field. If specified web sign-in can be restricted to given set of services or programmatic sign-in can be disabled for pool users.

ServiceConfig

Optional. Immutable. Services allowed for web sign-in with the workforce pool. If not set by default there are no restrictions.

bool

Optional. Disable programmatic sign-in by disabling token issue via the Security Token API endpoint. SeeSecurity Token Service API.

string

Optional. Domain name of the service.

Example: console.cloud.google

The pool is soft-deleted. Soft-deleted pools are permanently deleted after approximately 30 days. You can restore a soft-deleted pool usingUndeleteWorkforcePool.

You cannot reuse the ID of a soft-deleted pool until it is permanently deleted.

While a pool is deleted, you cannot use it to exchange tokens, or use existing tokens to access resources. If the pool is undeleted, existing tokens grant access again.

string

Identifier. The resource name of the provider.

Format:locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}

string

Optional. A display name for the provider.

Cannot exceed 32 characters.

string

Optional. A description of the provider. Cannot exceed 256 characters.

State

Output only. The state of the provider.

bool

Optional. Disables the workforce pool provider. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.

map<string, string>

Required. Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such assubject andsegment.

Each key must be a string specifying the Google Cloud IAM attribute to map to.

The following keys are supported:

• google.subject: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot exceed 127 bytes.

• google.groups: Groups the authenticating user belongs to. You can grant groups access to resources using an IAMprincipalSet binding; access applies to all members of the group.

• google.display_name: The name of the authenticated user. This is an optional field and the mapped display name cannot exceed 100 bytes. If not set,google.subject will be displayed instead. This attribute cannot be referenced in IAM bindings.

• google.profile_photo: The URL that specifies the authenticated user's thumbnail photo. This is an optional field. When set, the image will be visible as the user's profile picture. If not set, a generic user icon will be displayed instead. This attribute cannot be referenced in IAM bindings.

• google.posix_username: The Linux username used by OS Login. This is an optional field and the mapped POSIX username cannot exceed 32 characters. The key must match the regex "^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,31}$". This attribute cannot be referenced in IAM bindings.

You can also provide custom attributes by specifyingattribute.{custom_attribute}, where {custom_attribute} is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_].

You can reference these attributes in IAM policies to define fine-grained access for a workforce pool to Google Cloud resources. For example:

• google.subject:principal://iam.googleapis.com/locations/global/workforcePools/{pool}/subject/{value}

• google.groups:principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/group/{value}

• attribute.{custom_attribute}:principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/attribute.{custom_attribute}/{value}

Each value must be aCommon Expression Language function that maps an identity provider credential to the normalized attribute specified by the corresponding map key.

You can use theassertion keyword in the expression to access a JSON representation of the authentication credential issued by the provider.

The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 16 KB.

For OIDC providers, you must supply a custom mapping that includes thegoogle.subject attribute. For example, the following maps thesub claim of the incoming credential to thesubject attribute on a Google token:

{"google.subject": "assertion.sub"}

string

Optional. ACommon Expression Language expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted.

The expression must output a boolean representing whether to allow the federation.

The following keywords may be referenced in the expressions:

• assertion: JSON representing the authentication credential issued by the provider.
• google: The Google attributes mapped from the assertion in theattribute_mappings.google.profile_photo,google.display_name andgoogle.posix_username are not supported.
• attribute: The custom attributes mapped from the assertion in theattribute_mappings.

The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credentials will be accepted.

The following example shows how to only allow credentials with a mappedgoogle.groups value ofadmins:

"'admins' in google.groups"

Timestamp

Output only. Time after which the workforce identity pool provider will be permanently purged and cannot be recovered.

ExtraAttributesOAuth2Client

Optional. The configuration for OAuth 2.0 client used to get the additional user attributes. This should be used when users can't get the desired claims in authentication credentials. Currently, this configuration is only supported with OIDC protocol.

bool

Optional. If true, populates additional debug information in Cloud Audit Logs for this provider. Logged attribute mappings and values can be found insts.googleapis.com data access logs. Default value is false.

ExtraAttributesOAuth2Client

Optional. The configuration for OAuth 2.0 client used to get the extended group memberships for user identities. Only theAZURE_AD_GROUPS_ID attribute type is supported. Extended groups supports a subset of Google Cloud services. When the user accesses these services, extended group memberships override the mappedgoogle.groups attribute. Extended group memberships cannot be used in attribute mapping or attribute condition expressions.

To keep extended group memberships up to date, extended groups are retrieved when the user signs in and at regular intervals during the user's active session. Each user identity in the workforce identity pool must map to a unique Microsoft Entra ID user.

ScimUsage

Optional. Gemini Enterprise only. Specifies whether the workforce identity pool provider uses SCIM-managed groups instead of thegoogle.groups attribute mapping for authorization checks.

Thescim_usage andextended_attributes_oauth2_client fields are mutually exclusive. A request that enables both fields on the same workforce identity pool provider will produce an error.

Union fieldprovider_config.

provider_config can be only one of the following:

Saml

A SAML identity provider configuration.

Oidc

An OpenID Connect 1.0 identity provider configuration.

string

Required. The OIDC identity provider's issuer URI. Must be a valid URI using thehttps scheme. Required to get the OIDC discovery document.

string

Required. The OAuth 2.0 client ID for retrieving extra attributes from the identity provider. Required to get the Access Token using client credentials grant flow.

ClientSecret

Required. The OAuth 2.0 client secret for retrieving extra attributes from the identity provider. Required to get the Access Token using client credentials grant flow.

AttributesType

Required. Represents the IdP and type of claims that should be fetched.

QueryParameters

Optional. Represents the parameters to control which claims are fetched from an IdP.

Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. Themail property of themicrosoft.graph.group object is used for claim mapping. Seehttps://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details onmicrosoft.graph.group properties. The group mail addresses of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes:

• OIDC:assertion.groups
• SAML:assertion.attributes.groups

Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. Theid property of themicrosoft.graph.group object is used for claim mapping. Seehttps://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details onmicrosoft.graph.group properties. The group IDs of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes:

• OIDC:assertion.groups
• SAML:assertion.attributes.groups

string

Optional. The filter used to request specific records from the IdP. By default, all of the groups that are associated with a user are fetched. For Microsoft Entra ID, you can add$search query parameters usingKeyword Query Language. To learn more about$search querying in Microsoft Entra ID, seeUse the$search query parameter.

Additionally, Workforce Identity Federation automatically adds the following$filter query parameters, based on the value ofattributes_type. Values passed tofilter are converted to$search query parameters. Additional$filter query parameters cannot be added using this field.

• AZURE_AD_GROUPS_MAIL:mailEnabled andsecurityEnabled filters are applied.
• AZURE_AD_GROUPS_ID:securityEnabled filter is applied.

string

Required. The OIDC issuer URI. Must be a valid URI using thehttps scheme.

string

Required. The client ID. Must match the audience claim of the JWT issued by the identity provider.

ClientSecret

Optional. The optional client secret. Required to enable Authorization Code flow for web sign-in.

WebSsoConfig

Required. Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser.

string

Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, seehttps://tools.ietf.org/html/rfc7517. If not set, thejwks_uri from the discovery document that is fetched from the well-known path of theissuer_uri, will be used. RSA and EC asymmetric keys are supported. The JWK must use the following format and include only the following fields: { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] }

Union fieldsource.

source can be only one of the following:

Value

The value of the client secret.

string

Optional. Input only. The plain text of the client secret value. For security reasons, this field is only used for input and will never be populated in any response.

string

Output only. A thumbprint to represent the current client secret value.

ResponseType

Required. The Response Type to request for in the OIDC Authorization Request for web sign-in.

TheCODE Response Type is recommended to avoid the Implicit Flow, for security reasons.

AssertionClaimsBehavior

Required. The behavior for how OIDC Claims are included in theassertion object used for attribute mapping and attribute condition.

string

Optional. Additional scopes to request for in the OIDC authentication request on top of scopes requested by default. By default, theopenid,profile andemail scopes that are supported by the identity provider are requested.

Each additional scope may be at most 256 characters. A maximum of 10 additional scopes may be configured.

Union fieldidentity_provider.

identity_provider can be only one of the following:

string

Required. SAML Identity provider configuration metadata xml doc. The xml document should comply withSAML 2.0 specification. The max size of the acceptable xml document will be bounded to 128k characters.

The metadata xml document should satisfy the following constraints: 1) Must contain an Identity Provider Entity ID. 2) Must contain at least one non-expired signing key certificate. 3) For each signing key: a) Valid from should be no more than 7 days from now. b) Valid to should be no more than 25 years in the future. 4) Up to 3 IdP signing keys are allowed in the metadata xml.

When updating the provider's metadata xml, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.

string

Identifier. The resource name of the key.

Format:locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}/keys/{key_id}

KeyData

Immutable. Public half of the asymmetric key.

State

Output only. The state of the key.