{ "servicePath": "", "parameters": { "quotaUser": { "location": "query", "type": "string", "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters." }, "$.xgafv": { "enum": [ "1", "2" ], "description": "V1 error format.", "type": "string", "enumDescriptions": [ "v1 error format", "v2 error format" ], "location": "query" }, "upload_protocol": { "location": "query", "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").", "type": "string" }, "prettyPrint": { "description": "Returns response with indentations and line breaks.", "location": "query", "default": "true", "type": "boolean" }, "alt": { "default": "json", "type": "string", "description": "Data format for response.", "enum": [ "json", "media", "proto" ], "location": "query", "enumDescriptions": [ "Responses with Content-Type of application/json", "Media download with context-dependent Content-Type", "Responses with Content-Type of application/x-protobuf" ] }, "oauth_token": { "description": "OAuth 2.0 token for the current user.", "location": "query", "type": "string" }, "uploadType": { "type": "string", "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").", "location": "query" }, "callback": { "location": "query", "description": "JSONP", "type": "string" }, "key": { "type": "string", "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.", "location": "query" }, "access_token": { "type": "string", "description": "OAuth access token.", "location": "query" }, "fields": { "location": "query", "description": "Selector specifying which fields to include in a partial response.", "type": "string" } }, "schemas": { "GoogleTypeExpr": { "properties": { "location": { "type": "string", "description": "Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file." }, "title": { "type": "string", "description": "Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression." }, "expression": { "type": "string", "description": "Textual representation of an expression in Common Expression Language syntax." }, "description": { "description": "Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.", "type": "string" } }, "id": "GoogleTypeExpr", "type": "object", "description": "Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: \"Summary size limit\" description: \"Determines if a summary is less than 100 chars\" expression: \"document.summary.size() \u003c 100\" Example (Equality): title: \"Requestor is owner\" description: \"Determines if requestor is the document owner\" expression: \"document.owner == request.auth.claims.email\" Example (Logic): title: \"Public documents\" description: \"Determine whether the document should be publicly visible\" expression: \"document.type != 'private' && document.type != 'internal'\" Example (Data Manipulation): title: \"Notification string\" description: \"Create a notification string with a timestamp.\" expression: \"'New message received at ' + string(document.create_time)\" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information." }, "GoogleIamV3betaSearchPrincipalAccessBoundaryPolicyBindingsResponse": { "type": "object", "id": "GoogleIamV3betaSearchPrincipalAccessBoundaryPolicyBindingsResponse", "description": "Response message for SearchPrincipalAccessBoundaryPolicyBindings rpc.", "properties": { "policyBindings": { "description": "The policy bindings that reference the specified policy.", "type": "array", "items": { "$ref": "GoogleIamV3betaPolicyBinding" } }, "nextPageToken": { "type": "string", "description": "Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages." } } }, "GoogleIamV3betaAccessPolicyRuleOperation": { "type": "object", "id": "GoogleIamV3betaAccessPolicyRuleOperation", "properties": { "permissions": { "type": "array", "items": { "type": "string" }, "description": "Optional. The permissions that are explicitly affected by this rule. Each permission uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}` is the fully qualified domain name for the service. Currently supported permissions are as follows: * `eventarc.googleapis.com/messageBuses.publish`." }, "excludedPermissions": { "description": "Optional. Specifies the permissions that this rule excludes from the set of affected permissions given by `permissions`. If a permission appears in `permissions` _and_ in `excluded_permissions` then it will _not_ be subject to the policy effect. The excluded permissions can be specified using the same syntax as `permissions`.", "type": "array", "items": { "type": "string" } } }, "description": "Attributes that are used to determine whether this rule applies to a request." }, "GoogleIamV3betaListAccessPoliciesResponse": { "description": "Response message for ListAccessPolicies method.", "type": "object", "id": "GoogleIamV3betaListAccessPoliciesResponse", "properties": { "accessPolicies": { "description": "The access policies from the specified parent.", "items": { "$ref": "GoogleIamV3betaAccessPolicy" }, "type": "array" }, "nextPageToken": { "type": "string", "description": "Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages." } } }, "GoogleIamV3betaAccessPolicy": { "type": "object", "properties": { "etag": { "type": "string", "description": "Optional. The etag for the access policy. If this is provided on update, it must match the server's etag." }, "details": { "description": "Optional. The details for the access policy.", "$ref": "GoogleIamV3betaAccessPolicyDetails" }, "updateTime": { "format": "google-datetime", "type": "string", "readOnly": true, "description": "Output only. The time when the access policy was most recently updated." }, "displayName": { "description": "Optional. The description of the access policy. Must be less than or equal to 63 characters.", "type": "string" }, "uid": { "readOnly": true, "description": "Output only. The globally unique ID of the access policy.", "type": "string" }, "annotations": { "description": "Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations", "additionalProperties": { "type": "string" }, "type": "object" }, "name": { "type": "string", "description": "Identifier. The resource name of the access policy. The following formats are supported: * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`" }, "createTime": { "type": "string", "format": "google-datetime", "description": "Output only. The time when the access policy was created.", "readOnly": true } }, "description": "An IAM access policy resource.", "id": "GoogleIamV3betaAccessPolicy" }, "GoogleIamV3betaListPolicyBindingsResponse": { "properties": { "policyBindings": { "type": "array", "description": "The policy bindings from the specified parent.", "items": { "$ref": "GoogleIamV3betaPolicyBinding" } }, "nextPageToken": { "description": "Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.", "type": "string" } }, "description": "Response message for ListPolicyBindings method.", "id": "GoogleIamV3betaListPolicyBindingsResponse", "type": "object" }, "GoogleIamV3betaAccessPolicyDetails": { "id": "GoogleIamV3betaAccessPolicyDetails", "type": "object", "description": "Access policy details.", "properties": { "rules": { "type": "array", "description": "Required. A list of access policy rules.", "items": { "$ref": "GoogleIamV3betaAccessPolicyRule" } } } }, "GoogleRpcStatus": { "type": "object", "id": "GoogleRpcStatus", "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).", "properties": { "message": { "type": "string", "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client." }, "details": { "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.", "type": "array", "items": { "additionalProperties": { "description": "Properties of the object. Contains field @type with type URL.", "type": "any" }, "type": "object" } }, "code": { "format": "int32", "type": "integer", "description": "The status code, which should be an enum value of google.rpc.Code." } } }, "GoogleIamV3betaPolicyBinding": { "type": "object", "properties": { "target": { "description": "Required. Immutable. The full resource name of the resource to which the policy will be bound. Immutable once set.", "$ref": "GoogleIamV3betaPolicyBindingTarget" }, "createTime": { "type": "string", "readOnly": true, "description": "Output only. The time when the policy binding was created.", "format": "google-datetime" }, "uid": { "type": "string", "description": "Output only. The globally unique ID of the policy binding. Assigned when the policy binding is created.", "readOnly": true }, "condition": { "$ref": "GoogleTypeExpr", "description": "Optional. The condition to apply to the policy binding. When set, the `expression` field in the `Expr` must include from 1 to 10 subexpressions, joined by the \"||\"(Logical OR), \"&&\"(Logical AND) or \"!\"(Logical NOT) operators and cannot contain more than 250 characters. The condition is currently only supported when bound to policies of kind principal access boundary. When the bound policy is a principal access boundary policy, the only supported attributes in any subexpression are `principal.type` and `principal.subject`. An example expression is: \"principal.type == 'iam.googleapis.com/ServiceAccount'\" or \"principal.subject == 'bob@example.com'\". Allowed operations for `principal.subject`: - `principal.subject == ` - `principal.subject != ` - `principal.subject in []` - `principal.subject.startsWith()` - `principal.subject.endsWith()` Allowed operations for `principal.type`: - `principal.type == ` - `principal.type != ` - `principal.type in []` Supported principal types are workspace, workforce pool, workload pool, service account, and agent identity. Allowed string must be one of: - `iam.googleapis.com/WorkspaceIdentity` - `iam.googleapis.com/WorkforcePoolIdentity` - `iam.googleapis.com/WorkloadPoolIdentity` - `iam.googleapis.com/ServiceAccount` - `iam.googleapis.com/AgentPoolIdentity`" }, "policyUid": { "readOnly": true, "description": "Output only. The globally unique ID of the policy to be bound.", "type": "string" }, "name": { "description": "Identifier. The name of the policy binding, in the format `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`. The binding parent is the closest Resource Manager resource (project, folder, or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "type": "string" }, "policyKind": { "description": "Immutable. The kind of the policy to attach in this binding. This field must be one of the following: - Left empty (will be automatically set to the policy kind) - The input policy kind", "enum": [ "POLICY_KIND_UNSPECIFIED", "PRINCIPAL_ACCESS_BOUNDARY", "ACCESS" ], "enumDescriptions": [ "Unspecified policy kind; Not a valid state", "Principal access boundary policy kind", "Access policy kind." ], "type": "string" }, "displayName": { "description": "Optional. The description of the policy binding. Must be less than or equal to 63 characters.", "type": "string" }, "policy": { "description": "Required. Immutable. The resource name of the policy to be bound. The binding parent and policy must belong to the same organization.", "type": "string" }, "etag": { "type": "string", "description": "Optional. The etag for the policy binding. If this is provided on update, it must match the server's etag." }, "updateTime": { "format": "google-datetime", "type": "string", "description": "Output only. The time when the policy binding was most recently updated.", "readOnly": true }, "annotations": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Optional. User-defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations" } }, "id": "GoogleIamV3betaPolicyBinding", "description": "IAM policy binding resource." }, "GoogleIamV3betaPrincipalAccessBoundaryPolicyRule": { "description": "Principal access boundary policy rule that defines the resource boundary.", "properties": { "description": { "description": "Optional. The description of the principal access boundary policy rule. Must be less than or equal to 256 characters.", "type": "string" }, "effect": { "enum": [ "EFFECT_UNSPECIFIED", "ALLOW" ], "description": "Required. The access relationship of principals to the resources in this rule.", "type": "string", "enumDescriptions": [ "Effect unspecified.", "Allows access to the resources in this rule." ] }, "resources": { "type": "array", "description": "Required. A list of Resource Manager resources. If a resource is listed in the rule, then the rule applies for that resource and its descendants. The number of resources in a policy is limited to 500 across all rules in the policy. The following resource types are supported: * Organizations, such as `//cloudresourcemanager.googleapis.com/organizations/123`. * Folders, such as `//cloudresourcemanager.googleapis.com/folders/123`. * Projects, such as `//cloudresourcemanager.googleapis.com/projects/123` or `//cloudresourcemanager.googleapis.com/projects/my-project-id`.", "items": { "type": "string" } } }, "type": "object", "id": "GoogleIamV3betaPrincipalAccessBoundaryPolicyRule" }, "GoogleIamV3betaSearchAccessPolicyBindingsResponse": { "id": "GoogleIamV3betaSearchAccessPolicyBindingsResponse", "properties": { "nextPageToken": { "type": "string", "description": "Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages." }, "policyBindings": { "description": "The policy bindings that reference the specified policy.", "type": "array", "items": { "$ref": "GoogleIamV3betaPolicyBinding" } } }, "description": "Response message for SearchAccessPolicyBindings rpc.", "type": "object" }, "GoogleLongrunningOperation": { "properties": { "done": { "description": "If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.", "type": "boolean" }, "error": { "description": "The error result of the operation in case of failure or cancellation.", "$ref": "GoogleRpcStatus" }, "response": { "additionalProperties": { "description": "Properties of the object. Contains field @type with type URL.", "type": "any" }, "type": "object", "description": "The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`." }, "name": { "type": "string", "description": "The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`." }, "metadata": { "additionalProperties": { "description": "Properties of the object. Contains field @type with type URL.", "type": "any" }, "description": "Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.", "type": "object" } }, "description": "This resource represents a long-running operation that is the result of a network API call.", "id": "GoogleLongrunningOperation", "type": "object" }, "GoogleIamV3betaPrincipalAccessBoundaryPolicy": { "description": "An IAM principal access boundary policy resource.", "type": "object", "id": "GoogleIamV3betaPrincipalAccessBoundaryPolicy", "properties": { "name": { "description": "Identifier. The resource name of the principal access boundary policy. The following format is supported: `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}`", "type": "string" }, "annotations": { "description": "Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations", "additionalProperties": { "type": "string" }, "type": "object" }, "createTime": { "format": "google-datetime", "readOnly": true, "type": "string", "description": "Output only. The time when the principal access boundary policy was created." }, "updateTime": { "format": "google-datetime", "description": "Output only. The time when the principal access boundary policy was most recently updated.", "type": "string", "readOnly": true }, "etag": { "type": "string", "description": "Optional. The etag for the principal access boundary. If this is provided on update, it must match the server's etag." }, "uid": { "type": "string", "description": "Output only. The globally unique ID of the principal access boundary policy.", "readOnly": true }, "displayName": { "type": "string", "description": "Optional. The description of the principal access boundary policy. Must be less than or equal to 63 characters." }, "details": { "description": "Optional. The details for the principal access boundary policy.", "$ref": "GoogleIamV3betaPrincipalAccessBoundaryPolicyDetails" } } }, "GoogleIamV3betaAccessPolicyRule": { "properties": { "principals": { "type": "array", "description": "Required. The identities for which this rule's effect governs using one or more permissions on Google Cloud resources. This field can contain the following values: * `principal://goog/subject/{email_id}`: A specific Google Account. Includes Gmail, Cloud Identity, and Google Workspace user accounts. For example, `principal://goog/subject/alice@example.com`. * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`: A Google Cloud service account. For example, `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com`. * `principalSet://goog/group/{group_id}`: A Google group. For example, `principalSet://goog/group/admins@example.com`. * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the principals associated with the specified Google Workspace or Cloud Identity customer ID. For example, `principalSet://goog/cloudIdentityCustomerId/C01Abc35`. * `principalSet://goog/public:all`: A special identifier that represents any principal that is on the internet, even if they do not have a Google Account or are not logged in. `principalSet://goog/public:all` is only supported in `DENY` effect rule. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `principal://{trust_domain}/{agent_resource_path}/{agent_id}`: A single, specific agent identity. * `principalSet://{trust_domain}/*`: All agent identities belonging to a particular trust domain. * `principalSet://{trust_domain}/attribute.{attribute_name}/{attribute_value}`: All agents with a particular attribute. If an identifier that was previously set on a policy is soft deleted, then calls to read that policy will return the identifier with a deleted prefix. Users cannot set identifiers with this syntax. * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific Google Account that was deleted recently. For example, `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If the Google Account is recovered, this identifier reverts to the standard identifier for a Google Account. * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group that was deleted recently. For example, `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`. If the Google group is restored, this identifier reverts to the standard identifier for a Google group. * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`: A Google Cloud service account that was deleted recently. For example, `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`. If the service account is undeleted, this identifier reverts to the standard identifier for a service account. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A workforce identity that was deleted recently. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`. If the workforce identity is undeleted, this identifier reverts to the standard identifier for a workforce identity.", "items": { "type": "string" } }, "description": { "type": "string", "description": "Optional. Customer specified description of the rule. Must be less than or equal to 256 characters." }, "operation": { "description": "Required. Attributes that are used to determine whether this rule applies to a request.", "$ref": "GoogleIamV3betaAccessPolicyRuleOperation" }, "effect": { "enumDescriptions": [ "The effect is unspecified.", "The policy will deny access if it evaluates to true.", "The policy will grant access if it evaluates to true." ], "enum": [ "EFFECT_UNSPECIFIED", "DENY", "ALLOW" ], "description": "Required. The effect of the rule.", "type": "string" }, "excludedPrincipals": { "items": { "type": "string" }, "description": "Optional. The identities that are excluded from the access policy rule, even if they are listed in the `principals`. For example, you could add a Google group to the `principals`, then exclude specific users who belong to that group.", "type": "array" }, "conditions": { "type": "object", "description": "Optional. The conditions that determine whether this rule applies to a request. Conditions are identified by their key, which is the FQDN of the service that they are relevant to. For example: ``` \"conditions\": { \"iam.googleapis.com\": { \"expression\": } } ``` Each rule is evaluated independently. If this rule does not apply to a request, other rules might still apply. Currently supported keys are as follows: * `eventarc.googleapis.com`: Can use `CEL` functions that evaluate resource fields. * `iam.googleapis.com`: Can use `CEL` functions that evaluate [resource tags](https://cloud.google.com/iam/help/conditions/resource-tags) and combine them using boolean and logical operators. Other functions and operators are not supported.", "additionalProperties": { "$ref": "GoogleTypeExpr" } } }, "type": "object", "id": "GoogleIamV3betaAccessPolicyRule", "description": "Access Policy Rule that determines the behavior of the policy." }, "GoogleIamV3betaOperationMetadata": { "description": "Represents the metadata of the long-running operation.", "type": "object", "id": "GoogleIamV3betaOperationMetadata", "properties": { "apiVersion": { "description": "Output only. API version used to start the operation.", "type": "string", "readOnly": true }, "endTime": { "format": "google-datetime", "type": "string", "description": "Output only. The time the operation finished running.", "readOnly": true }, "statusMessage": { "readOnly": true, "description": "Output only. Human-readable status of the operation, if any.", "type": "string" }, "requestedCancellation": { "type": "boolean", "description": "Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.", "readOnly": true }, "target": { "readOnly": true, "type": "string", "description": "Output only. Server-defined resource path for the target of the" }, "createTime": { "type": "string", "description": "Output only. The time the operation was created.", "format": "google-datetime", "readOnly": true }, "verb": { "description": "Output only. Name of the verb executed by the operation.", "readOnly": true, "type": "string" } } }, "GoogleIamAdminV1AuditData": { "properties": { "permissionDelta": { "$ref": "GoogleIamAdminV1AuditDataPermissionDelta", "description": "The permission_delta when when creating or updating a Role." } }, "description": "Audit log information specific to Cloud IAM admin APIs. This message is serialized as an `Any` type in the `ServiceData` message of an `AuditLog` message.", "id": "GoogleIamAdminV1AuditData", "type": "object" }, "GoogleIamAdminV1AuditDataPermissionDelta": { "properties": { "removedPermissions": { "items": { "type": "string" }, "type": "array", "description": "Removed permissions." }, "addedPermissions": { "description": "Added permissions.", "items": { "type": "string" }, "type": "array" } }, "description": "A PermissionDelta message to record the added_permissions and removed_permissions inside a role.", "id": "GoogleIamAdminV1AuditDataPermissionDelta", "type": "object" }, "GoogleIamV3betaPrincipalAccessBoundaryPolicyDetails": { "id": "GoogleIamV3betaPrincipalAccessBoundaryPolicyDetails", "properties": { "enforcementVersion": { "description": "Optional. The version number (for example, `1` or `latest`) that indicates which permissions are able to be blocked by the policy. If empty, the PAB policy version will be set to the most recent version number at the time of the policy's creation.", "type": "string" }, "rules": { "type": "array", "description": "Required. A list of principal access boundary policy rules. The number of rules in a policy is limited to 500.", "items": { "$ref": "GoogleIamV3betaPrincipalAccessBoundaryPolicyRule" } } }, "type": "object", "description": "Principal access boundary policy details" }, "GoogleIamV3betaListPrincipalAccessBoundaryPoliciesResponse": { "id": "GoogleIamV3betaListPrincipalAccessBoundaryPoliciesResponse", "type": "object", "properties": { "principalAccessBoundaryPolicies": { "description": "The principal access boundary policies from the specified parent.", "items": { "$ref": "GoogleIamV3betaPrincipalAccessBoundaryPolicy" }, "type": "array" }, "nextPageToken": { "description": "Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.", "type": "string" } }, "description": "Response message for ListPrincipalAccessBoundaryPolicies method." }, "GoogleIamV3betaSearchTargetPolicyBindingsResponse": { "properties": { "policyBindings": { "type": "array", "items": { "$ref": "GoogleIamV3betaPolicyBinding" }, "description": "The policy bindings bound to the specified target." }, "nextPageToken": { "description": "Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.", "type": "string" } }, "description": "Response message for SearchTargetPolicyBindings method.", "id": "GoogleIamV3betaSearchTargetPolicyBindingsResponse", "type": "object" }, "GoogleIamV3betaPolicyBindingTarget": { "description": "The full resource name of the resource to which the policy will be bound. Immutable once set.", "type": "object", "id": "GoogleIamV3betaPolicyBindingTarget", "properties": { "resource": { "description": "Immutable. The full resource name that's used for access policy bindings. Examples: * Organization: `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID` * Folder: `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID` * Project: * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER` * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`", "type": "string" }, "principalSet": { "type": "string", "description": "Immutable. The full resource name that's used for principal access boundary policy bindings. The principal set must be directly parented by the policy binding's parent or same as the parent if the target is a project, folder, or organization. Examples: * For bindings parented by an organization: * Organization: `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID` * Workforce Identity: `//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID` * Workspace Identity: `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID` * For bindings parented by a folder: * Folder: `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID` * For bindings parented by a project: * Project: * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER` * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID` * Workload Identity Pool: `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/LOCATION/workloadIdentityPools/WORKLOAD_POOL_ID`" } } } }, "revision": "20261012", "mtlsRootUrl": "https://iam.mtls.googleapis.com/", "version_module": true, "batchPath": "batch", "fullyEncodeReservedExpansion": true, "description": "Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. ", "documentationLink": "https://cloud.google.com/iam/", "canonicalName": "Iam", "id": "iam:v3beta", "ownerName": "Google", "auth": { "oauth2": { "scopes": { "https://www.googleapis.com/auth/cloud-platform": { "description": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account." } } } }, "kind": "discovery#restDescription", "resources": { "folders": { "resources": { "locations": { "resources": { "operations": { "methods": { "get": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "id": "iam.folders.locations.operations.get", "response": { "$ref": "GoogleLongrunningOperation" }, "httpMethod": "GET", "parameters": { "name": { "required": true, "pattern": "^folders/[^/]+/locations/[^/]+/operations/[^/]+$", "description": "The name of the operation resource.", "location": "path", "type": "string" } }, "path": "v3beta/{+name}", "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/operations/{operationsId}", "description": "Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service." } } }, "policyBindings": { "methods": { "delete": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "path": "v3beta/{+name}", "parameterOrder": [ "name" ], "response": { "$ref": "GoogleLongrunningOperation" }, "id": "iam.folders.locations.policyBindings.delete", "httpMethod": "DELETE", "parameters": { "name": { "type": "string", "location": "path", "pattern": "^folders/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "description": "Required. The name of the policy binding to delete. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "required": true }, "etag": { "description": "Optional. The etag of the policy binding. If this is provided, it must match the server's etag.", "type": "string", "location": "query" }, "validateOnly": { "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it.", "type": "boolean", "location": "query" } }, "description": "Deletes a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is deleted, the policy no longer applies to the target." }, "get": { "response": { "$ref": "GoogleIamV3betaPolicyBinding" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "parameters": { "name": { "required": true, "location": "path", "pattern": "^folders/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "description": "Required. The name of the policy binding to retrieve. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "type": "string" } }, "id": "iam.folders.locations.policyBindings.get", "parameterOrder": [ "name" ], "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "description": "Gets a policy binding.", "path": "v3beta/{+name}" }, "list": { "httpMethod": "GET", "parameters": { "pageSize": { "format": "int32", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000.", "location": "query", "type": "integer" }, "pageToken": { "location": "query", "type": "string", "description": "Optional. A page token, received from a previous `ListPolicyBindings` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListPolicyBindings` must match the call that provided the page token." }, "filter": { "description": "Optional. An expression for filtering the results of the request. Filter rules are case insensitive. Some eligible fields for filtering are the following: + `target` + `policy` Some examples of filter queries: * `target:ex*`: The binding target's name starts with \"ex\". * `target:example`: The binding target's name is `example`. * `policy:example`: The binding policy's name is `example`.", "type": "string", "location": "query" }, "parent": { "description": "Required. The parent resource, which owns the collection of policy bindings. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "location": "path", "type": "string", "required": true, "pattern": "^folders/[^/]+/locations/[^/]+$" } }, "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/policyBindings", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Lists policy bindings.", "parameterOrder": [ "parent" ], "path": "v3beta/{+parent}/policyBindings", "id": "iam.folders.locations.policyBindings.list", "response": { "$ref": "GoogleIamV3betaListPolicyBindingsResponse" } }, "searchTargetPolicyBindings": { "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/policyBindings:searchTargetPolicyBindings", "parameterOrder": [ "parent" ], "path": "v3beta/{+parent}/policyBindings:searchTargetPolicyBindings", "description": "Search policy bindings by target. Returns all policy binding objects bound directly to target.", "response": { "$ref": "GoogleIamV3betaSearchTargetPolicyBindingsResponse" }, "httpMethod": "GET", "parameters": { "pageToken": { "type": "string", "location": "query", "description": "Optional. A page token, received from a previous `SearchTargetPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchTargetPolicyBindingsRequest` must match the call that provided the page token." }, "pageSize": { "type": "integer", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000.", "location": "query", "format": "int32" }, "parent": { "description": "Required. The parent resource where this search will be performed. This should be the nearest Resource Manager resource (project, folder, or organization) to the target. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "required": true, "pattern": "^folders/[^/]+/locations/[^/]+$", "type": "string", "location": "path" }, "filter": { "location": "query", "type": "string", "description": "Optional. Filtering currently only supports the kind of policies to return, and must be in the format \"policy_kind={policy_kind}\". If String is empty, bindings bound to all kinds of policies would be returned. The only supported values are the following: * \"policy_kind=PRINCIPAL_ACCESS_BOUNDARY\", * \"policy_kind=ACCESS\"" }, "target": { "description": "Required. The target resource, which is bound to the policy in the binding. Format: * `//iam.googleapis.com/locations/global/workforcePools/POOL_ID` * `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID` * `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID` * `//cloudresourcemanager.googleapis.com/projects/{project_number}` * `//cloudresourcemanager.googleapis.com/folders/{folder_id}` * `//cloudresourcemanager.googleapis.com/organizations/{organization_id}`", "type": "string", "location": "query" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "iam.folders.locations.policyBindings.searchTargetPolicyBindings" }, "create": { "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/policyBindings", "id": "iam.folders.locations.policyBindings.create", "request": { "$ref": "GoogleIamV3betaPolicyBinding" }, "response": { "$ref": "GoogleLongrunningOperation" }, "httpMethod": "POST", "parameters": { "policyBindingId": { "type": "string", "description": "Required. The ID to use for the policy binding, which will become the final component of the policy binding's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/.", "location": "query" }, "parent": { "type": "string", "location": "path", "pattern": "^folders/[^/]+/locations/[^/]+$", "required": true, "description": "Required. The parent resource where this policy binding will be created. The binding parent is the closest Resource Manager resource (project, folder or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`" }, "validateOnly": { "location": "query", "type": "boolean", "description": "Optional. If set, validate the request and preview the creation, but do not actually post it." } }, "description": "Creates a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is created, the policy is applied to the target.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "parent" ], "path": "v3beta/{+parent}/policyBindings" }, "patch": { "response": { "$ref": "GoogleLongrunningOperation" }, "httpMethod": "PATCH", "parameters": { "updateMask": { "type": "string", "description": "Optional. The list of fields to update", "format": "google-fieldmask", "location": "query" }, "name": { "location": "path", "description": "Identifier. The name of the policy binding, in the format `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`. The binding parent is the closest Resource Manager resource (project, folder, or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "pattern": "^folders/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "type": "string", "required": true }, "validateOnly": { "location": "query", "type": "boolean", "description": "Optional. If set, validate the request and preview the update, but do not actually post it." } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "iam.folders.locations.policyBindings.patch", "path": "v3beta/{+name}", "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "parameterOrder": [ "name" ], "request": { "$ref": "GoogleIamV3betaPolicyBinding" }, "description": "Updates a policy binding and returns a long-running operation. Callers will need the IAM permissions on the policy and target in the binding to update. Target and policy are immutable and cannot be updated." } } }, "accessPolicies": { "methods": { "searchPolicyBindings": { "response": { "$ref": "GoogleIamV3betaSearchAccessPolicyBindingsResponse" }, "description": "Returns all policy bindings that bind a specific policy if a user has searchPolicyBindings permission on that policy.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "parameters": { "pageToken": { "location": "query", "description": "Optional. A page token, received from a previous `SearchAccessPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchAccessPolicyBindingsRequest` must match the call that provided the page token.", "type": "string" }, "pageSize": { "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. If unspecified, at most 50 policy bindings will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.", "type": "integer", "format": "int32", "location": "query" }, "name": { "required": true, "pattern": "^folders/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "description": "Required. The name of the access policy. Format: `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`", "location": "path", "type": "string" } }, "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}:searchPolicyBindings", "path": "v3beta/{+name}:searchPolicyBindings", "parameterOrder": [ "name" ], "id": "iam.folders.locations.accessPolicies.searchPolicyBindings" }, "get": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v3beta/{+name}", "httpMethod": "GET", "parameters": { "name": { "description": "Required. The name of the access policy to retrieve. Format: `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`", "required": true, "pattern": "^folders/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "type": "string", "location": "path" } }, "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "description": "Gets an access policy.", "id": "iam.folders.locations.accessPolicies.get", "parameterOrder": [ "name" ], "response": { "$ref": "GoogleIamV3betaAccessPolicy" } }, "create": { "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/accessPolicies", "path": "v3beta/{+parent}/accessPolicies", "httpMethod": "POST", "parameters": { "accessPolicyId": { "location": "query", "type": "string", "description": "Required. The ID to use for the access policy, which will become the final component of the access policy's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/. This value must be unique among all access policies with the same parent." }, "validateOnly": { "location": "query", "description": "Optional. If set, validate the request and preview the creation, but do not actually post it.", "type": "boolean" }, "parent": { "location": "path", "type": "string", "pattern": "^folders/[^/]+/locations/[^/]+$", "required": true, "description": "Required. The parent resource where this access policy will be created. Format: `projects/{project_id}/locations/{location}` `projects/{project_number}/locations/{location}` `folders/{folder_id}/locations/{location}` `organizations/{organization_id}/locations/{location}`" } }, "parameterOrder": [ "parent" ], "description": "Creates an access policy, and returns a long running operation.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" }, "request": { "$ref": "GoogleIamV3betaAccessPolicy" }, "id": "iam.folders.locations.accessPolicies.create" }, "patch": { "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "request": { "$ref": "GoogleIamV3betaAccessPolicy" }, "description": "Updates an access policy.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" }, "parameterOrder": [ "name" ], "httpMethod": "PATCH", "parameters": { "name": { "type": "string", "description": "Identifier. The resource name of the access policy. The following formats are supported: * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`", "required": true, "pattern": "^folders/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "location": "path" }, "validateOnly": { "description": "Optional. If set, validate the request and preview the update, but do not actually post it.", "location": "query", "type": "boolean" } }, "id": "iam.folders.locations.accessPolicies.patch", "path": "v3beta/{+name}" }, "delete": { "parameterOrder": [ "name" ], "httpMethod": "DELETE", "parameters": { "name": { "type": "string", "description": "Required. The name of the access policy to delete. Format: `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`", "location": "path", "pattern": "^folders/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "required": true }, "etag": { "location": "query", "type": "string", "description": "Optional. The etag of the access policy. If this is provided, it must match the server's etag." }, "validateOnly": { "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it.", "type": "boolean", "location": "query" }, "force": { "type": "boolean", "location": "query", "description": "Optional. If set to true, the request will force the deletion of the Policy even if the Policy references PolicyBindings." } }, "description": "Deletes an access policy.", "response": { "$ref": "GoogleLongrunningOperation" }, "path": "v3beta/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "iam.folders.locations.accessPolicies.delete", "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}" }, "list": { "response": { "$ref": "GoogleIamV3betaListAccessPoliciesResponse" }, "description": "Lists access policies.", "id": "iam.folders.locations.accessPolicies.list", "httpMethod": "GET", "parameters": { "pageSize": { "location": "query", "format": "int32", "type": "integer", "description": "Optional. The maximum number of access policies to return. The service may return fewer than this value. If unspecified, at most 50 access policies will be returned. Valid value ranges from 1 to 1000; values above 1000 will be coerced to 1000." }, "filter": { "type": "string", "location": "query", "description": "Optional. An expression for filtering the results of the request. Example filter query: `display_name:example*` matches access policies whose display name starts with \"example\"." }, "pageToken": { "type": "string", "description": "Optional. A page token, received from a previous `ListAccessPolicies` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListAccessPolicies` must match the call that provided the page token.", "location": "query" }, "parent": { "description": "Required. The parent resource, which owns the collection of access policy resources. Format: `projects/{project_id}/locations/{location}` `projects/{project_number}/locations/{location}` `folders/{folder_id}/locations/{location}` `organizations/{organization_id}/locations/{location}`", "required": true, "type": "string", "location": "path", "pattern": "^folders/[^/]+/locations/[^/]+$" } }, "flatPath": "v3beta/folders/{foldersId}/locations/{locationsId}/accessPolicies", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "parent" ], "path": "v3beta/{+parent}/accessPolicies" } } } } } } }, "organizations": { "resources": { "locations": { "resources": { "accessPolicies": { "methods": { "list": { "response": { "$ref": "GoogleIamV3betaListAccessPoliciesResponse" }, "id": "iam.organizations.locations.accessPolicies.list", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "parent" ], "description": "Lists access policies.", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/accessPolicies", "httpMethod": "GET", "parameters": { "pageSize": { "format": "int32", "location": "query", "type": "integer", "description": "Optional. The maximum number of access policies to return. The service may return fewer than this value. If unspecified, at most 50 access policies will be returned. Valid value ranges from 1 to 1000; values above 1000 will be coerced to 1000." }, "pageToken": { "description": "Optional. A page token, received from a previous `ListAccessPolicies` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListAccessPolicies` must match the call that provided the page token.", "location": "query", "type": "string" }, "filter": { "type": "string", "description": "Optional. An expression for filtering the results of the request. Example filter query: `display_name:example*` matches access policies whose display name starts with \"example\".", "location": "query" }, "parent": { "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+$", "type": "string", "description": "Required. The parent resource, which owns the collection of access policy resources. Format: `projects/{project_id}/locations/{location}` `projects/{project_number}/locations/{location}` `folders/{folder_id}/locations/{location}` `organizations/{organization_id}/locations/{location}`", "required": true } }, "path": "v3beta/{+parent}/accessPolicies" }, "delete": { "httpMethod": "DELETE", "parameters": { "force": { "description": "Optional. If set to true, the request will force the deletion of the Policy even if the Policy references PolicyBindings.", "type": "boolean", "location": "query" }, "validateOnly": { "location": "query", "type": "boolean", "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it." }, "name": { "type": "string", "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "description": "Required. The name of the access policy to delete. Format: `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`", "required": true }, "etag": { "description": "Optional. The etag of the access policy. If this is provided, it must match the server's etag.", "location": "query", "type": "string" } }, "response": { "$ref": "GoogleLongrunningOperation" }, "path": "v3beta/{+name}", "id": "iam.organizations.locations.accessPolicies.delete", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "description": "Deletes an access policy.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ] }, "patch": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "path": "v3beta/{+name}", "httpMethod": "PATCH", "parameters": { "validateOnly": { "location": "query", "type": "boolean", "description": "Optional. If set, validate the request and preview the update, but do not actually post it." }, "name": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "description": "Identifier. The resource name of the access policy. The following formats are supported: * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`", "type": "string", "location": "path" } }, "response": { "$ref": "GoogleLongrunningOperation" }, "description": "Updates an access policy.", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "id": "iam.organizations.locations.accessPolicies.patch", "request": { "$ref": "GoogleIamV3betaAccessPolicy" } }, "get": { "parameterOrder": [ "name" ], "id": "iam.organizations.locations.accessPolicies.get", "httpMethod": "GET", "parameters": { "name": { "type": "string", "description": "Required. The name of the access policy to retrieve. Format: `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "location": "path" } }, "response": { "$ref": "GoogleIamV3betaAccessPolicy" }, "path": "v3beta/{+name}", "description": "Gets an access policy.", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "create": { "id": "iam.organizations.locations.accessPolicies.create", "parameterOrder": [ "parent" ], "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/accessPolicies", "httpMethod": "POST", "parameters": { "validateOnly": { "type": "boolean", "description": "Optional. If set, validate the request and preview the creation, but do not actually post it.", "location": "query" }, "accessPolicyId": { "description": "Required. The ID to use for the access policy, which will become the final component of the access policy's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/. This value must be unique among all access policies with the same parent.", "location": "query", "type": "string" }, "parent": { "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+$", "required": true, "description": "Required. The parent resource where this access policy will be created. Format: `projects/{project_id}/locations/{location}` `projects/{project_number}/locations/{location}` `folders/{folder_id}/locations/{location}` `organizations/{organization_id}/locations/{location}`", "type": "string" } }, "path": "v3beta/{+parent}/accessPolicies", "description": "Creates an access policy, and returns a long running operation.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "request": { "$ref": "GoogleIamV3betaAccessPolicy" }, "response": { "$ref": "GoogleLongrunningOperation" } }, "searchPolicyBindings": { "response": { "$ref": "GoogleIamV3betaSearchAccessPolicyBindingsResponse" }, "path": "v3beta/{+name}:searchPolicyBindings", "description": "Returns all policy bindings that bind a specific policy if a user has searchPolicyBindings permission on that policy.", "httpMethod": "GET", "parameters": { "pageSize": { "type": "integer", "location": "query", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. If unspecified, at most 50 policy bindings will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.", "format": "int32" }, "name": { "pattern": "^organizations/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "location": "path", "description": "Required. The name of the access policy. Format: `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`", "type": "string", "required": true }, "pageToken": { "type": "string", "location": "query", "description": "Optional. A page token, received from a previous `SearchAccessPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchAccessPolicyBindingsRequest` must match the call that provided the page token." } }, "parameterOrder": [ "name" ], "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}:searchPolicyBindings", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "iam.organizations.locations.accessPolicies.searchPolicyBindings" } } }, "operations": { "methods": { "get": { "httpMethod": "GET", "parameters": { "name": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/operations/[^/]+$", "description": "The name of the operation resource.", "location": "path", "type": "string" } }, "path": "v3beta/{+name}", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/operations/{operationsId}", "response": { "$ref": "GoogleLongrunningOperation" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "description": "Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.", "id": "iam.organizations.locations.operations.get" } } }, "principalAccessBoundaryPolicies": { "methods": { "list": { "parameterOrder": [ "parent" ], "httpMethod": "GET", "parameters": { "pageSize": { "description": "Optional. The maximum number of principal access boundary policies to return. The service may return fewer than this value. If unspecified, at most 50 principal access boundary policies will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.", "location": "query", "type": "integer", "format": "int32" }, "parent": { "location": "path", "description": "Required. The parent resource, which owns the collection of principal access boundary policies. Format: `organizations/{organization_id}/locations/{location}`", "pattern": "^organizations/[^/]+/locations/[^/]+$", "type": "string", "required": true }, "pageToken": { "type": "string", "location": "query", "description": "Optional. A page token, received from a previous `ListPrincipalAccessBoundaryPolicies` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListPrincipalAccessBoundaryPolicies` must match the call that provided the page token." }, "filter": { "description": "Optional. An expression for filtering the results of the request. Example filter query: `display_name:example*` matches principal access boundary policies whose display name starts with \"example\".", "type": "string", "location": "query" } }, "response": { "$ref": "GoogleIamV3betaListPrincipalAccessBoundaryPoliciesResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "iam.organizations.locations.principalAccessBoundaryPolicies.list", "path": "v3beta/{+parent}/principalAccessBoundaryPolicies", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/principalAccessBoundaryPolicies", "description": "Lists principal access boundary policies." }, "searchPolicyBindings": { "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/principalAccessBoundaryPolicies/{principalAccessBoundaryPoliciesId}:searchPolicyBindings", "parameterOrder": [ "name" ], "httpMethod": "GET", "parameters": { "pageSize": { "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. If unspecified, at most 50 policy bindings will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.", "format": "int32", "type": "integer", "location": "query" }, "pageToken": { "type": "string", "description": "Optional. A page token, received from a previous `SearchPrincipalAccessBoundaryPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchPrincipalAccessBoundaryPolicyBindingsRequest` must match the call that provided the page token.", "location": "query" }, "name": { "location": "path", "description": "Required. The name of the principal access boundary policy. Format: `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}`", "pattern": "^organizations/[^/]+/locations/[^/]+/principalAccessBoundaryPolicies/[^/]+$", "type": "string", "required": true } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v3beta/{+name}:searchPolicyBindings", "description": "Returns all policy bindings that bind a specific policy if a user has searchPolicyBindings permission on that policy.", "id": "iam.organizations.locations.principalAccessBoundaryPolicies.searchPolicyBindings", "response": { "$ref": "GoogleIamV3betaSearchPrincipalAccessBoundaryPolicyBindingsResponse" } }, "delete": { "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/principalAccessBoundaryPolicies/{principalAccessBoundaryPoliciesId}", "description": "Deletes a principal access boundary policy.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "path": "v3beta/{+name}", "id": "iam.organizations.locations.principalAccessBoundaryPolicies.delete", "httpMethod": "DELETE", "parameters": { "name": { "type": "string", "description": "Required. The name of the principal access boundary policy to delete. Format: `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}`", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/principalAccessBoundaryPolicies/[^/]+$", "location": "path" }, "etag": { "description": "Optional. The etag of the principal access boundary policy. If this is provided, it must match the server's etag.", "type": "string", "location": "query" }, "force": { "type": "boolean", "description": "Optional. If set to true, the request will force the deletion of the policy even if the policy is referenced in policy bindings.", "location": "query" }, "validateOnly": { "type": "boolean", "location": "query", "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it." } }, "response": { "$ref": "GoogleLongrunningOperation" } }, "patch": { "parameterOrder": [ "name" ], "request": { "$ref": "GoogleIamV3betaPrincipalAccessBoundaryPolicy" }, "httpMethod": "PATCH", "parameters": { "updateMask": { "location": "query", "description": "Optional. The list of fields to update", "format": "google-fieldmask", "type": "string" }, "name": { "pattern": "^organizations/[^/]+/locations/[^/]+/principalAccessBoundaryPolicies/[^/]+$", "required": true, "location": "path", "type": "string", "description": "Identifier. The resource name of the principal access boundary policy. The following format is supported: `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}`" }, "validateOnly": { "type": "boolean", "location": "query", "description": "Optional. If set, validate the request and preview the update, but do not actually post it." } }, "response": { "$ref": "GoogleLongrunningOperation" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "iam.organizations.locations.principalAccessBoundaryPolicies.patch", "path": "v3beta/{+name}", "description": "Updates a principal access boundary policy.", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/principalAccessBoundaryPolicies/{principalAccessBoundaryPoliciesId}" }, "get": { "response": { "$ref": "GoogleIamV3betaPrincipalAccessBoundaryPolicy" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "parameters": { "name": { "location": "path", "description": "Required. The name of the principal access boundary policy to retrieve. Format: `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}`", "pattern": "^organizations/[^/]+/locations/[^/]+/principalAccessBoundaryPolicies/[^/]+$", "type": "string", "required": true } }, "parameterOrder": [ "name" ], "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/principalAccessBoundaryPolicies/{principalAccessBoundaryPoliciesId}", "description": "Gets a principal access boundary policy.", "path": "v3beta/{+name}", "id": "iam.organizations.locations.principalAccessBoundaryPolicies.get" }, "create": { "request": { "$ref": "GoogleIamV3betaPrincipalAccessBoundaryPolicy" }, "response": { "$ref": "GoogleLongrunningOperation" }, "description": "Creates a principal access boundary policy, and returns a long running operation.", "id": "iam.organizations.locations.principalAccessBoundaryPolicies.create", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/principalAccessBoundaryPolicies", "parameterOrder": [ "parent" ], "path": "v3beta/{+parent}/principalAccessBoundaryPolicies", "httpMethod": "POST", "parameters": { "validateOnly": { "type": "boolean", "description": "Optional. If set, validate the request and preview the creation, but do not actually post it.", "location": "query" }, "parent": { "pattern": "^organizations/[^/]+/locations/[^/]+$", "required": true, "type": "string", "description": "Required. The parent resource where this principal access boundary policy will be created. Only organizations are supported. Format: `organizations/{organization_id}/locations/{location}`", "location": "path" }, "principalAccessBoundaryPolicyId": { "description": "Required. The ID to use for the principal access boundary policy, which will become the final component of the principal access boundary policy's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/.", "location": "query", "type": "string" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] } } }, "policyBindings": { "methods": { "get": { "description": "Gets a policy binding.", "httpMethod": "GET", "parameters": { "name": { "location": "path", "type": "string", "required": true, "description": "Required. The name of the policy binding to retrieve. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "pattern": "^organizations/[^/]+/locations/[^/]+/policyBindings/[^/]+$" } }, "id": "iam.organizations.locations.policyBindings.get", "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "path": "v3beta/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "response": { "$ref": "GoogleIamV3betaPolicyBinding" } }, "list": { "description": "Lists policy bindings.", "response": { "$ref": "GoogleIamV3betaListPolicyBindingsResponse" }, "httpMethod": "GET", "parameters": { "pageSize": { "format": "int32", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000.", "location": "query", "type": "integer" }, "filter": { "type": "string", "location": "query", "description": "Optional. An expression for filtering the results of the request. Filter rules are case insensitive. Some eligible fields for filtering are the following: + `target` + `policy` Some examples of filter queries: * `target:ex*`: The binding target's name starts with \"ex\". * `target:example`: The binding target's name is `example`. * `policy:example`: The binding policy's name is `example`." }, "parent": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+$", "description": "Required. The parent resource, which owns the collection of policy bindings. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "type": "string", "location": "path" }, "pageToken": { "description": "Optional. A page token, received from a previous `ListPolicyBindings` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListPolicyBindings` must match the call that provided the page token.", "type": "string", "location": "query" } }, "path": "v3beta/{+parent}/policyBindings", "id": "iam.organizations.locations.policyBindings.list", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/policyBindings", "parameterOrder": [ "parent" ] }, "patch": { "parameterOrder": [ "name" ], "response": { "$ref": "GoogleLongrunningOperation" }, "description": "Updates a policy binding and returns a long-running operation. Callers will need the IAM permissions on the policy and target in the binding to update. Target and policy are immutable and cannot be updated.", "httpMethod": "PATCH", "parameters": { "updateMask": { "description": "Optional. The list of fields to update", "format": "google-fieldmask", "location": "query", "type": "string" }, "name": { "type": "string", "description": "Identifier. The name of the policy binding, in the format `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`. The binding parent is the closest Resource Manager resource (project, folder, or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "location": "path" }, "validateOnly": { "type": "boolean", "description": "Optional. If set, validate the request and preview the update, but do not actually post it.", "location": "query" } }, "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "path": "v3beta/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "request": { "$ref": "GoogleIamV3betaPolicyBinding" }, "id": "iam.organizations.locations.policyBindings.patch" }, "create": { "parameterOrder": [ "parent" ], "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/policyBindings", "description": "Creates a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is created, the policy is applied to the target.", "id": "iam.organizations.locations.policyBindings.create", "httpMethod": "POST", "parameters": { "policyBindingId": { "description": "Required. The ID to use for the policy binding, which will become the final component of the policy binding's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/.", "type": "string", "location": "query" }, "parent": { "location": "path", "type": "string", "pattern": "^organizations/[^/]+/locations/[^/]+$", "description": "Required. The parent resource where this policy binding will be created. The binding parent is the closest Resource Manager resource (project, folder or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "required": true }, "validateOnly": { "description": "Optional. If set, validate the request and preview the creation, but do not actually post it.", "type": "boolean", "location": "query" } }, "path": "v3beta/{+parent}/policyBindings", "request": { "$ref": "GoogleIamV3betaPolicyBinding" }, "response": { "$ref": "GoogleLongrunningOperation" } }, "searchTargetPolicyBindings": { "response": { "$ref": "GoogleIamV3betaSearchTargetPolicyBindingsResponse" }, "httpMethod": "GET", "parameters": { "pageSize": { "type": "integer", "location": "query", "format": "int32", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000." }, "parent": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+$", "location": "path", "type": "string", "description": "Required. The parent resource where this search will be performed. This should be the nearest Resource Manager resource (project, folder, or organization) to the target. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`" }, "pageToken": { "type": "string", "description": "Optional. A page token, received from a previous `SearchTargetPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchTargetPolicyBindingsRequest` must match the call that provided the page token.", "location": "query" }, "target": { "location": "query", "description": "Required. The target resource, which is bound to the policy in the binding. Format: * `//iam.googleapis.com/locations/global/workforcePools/POOL_ID` * `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID` * `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID` * `//cloudresourcemanager.googleapis.com/projects/{project_number}` * `//cloudresourcemanager.googleapis.com/folders/{folder_id}` * `//cloudresourcemanager.googleapis.com/organizations/{organization_id}`", "type": "string" }, "filter": { "description": "Optional. Filtering currently only supports the kind of policies to return, and must be in the format \"policy_kind={policy_kind}\". If String is empty, bindings bound to all kinds of policies would be returned. The only supported values are the following: * \"policy_kind=PRINCIPAL_ACCESS_BOUNDARY\", * \"policy_kind=ACCESS\"", "type": "string", "location": "query" } }, "parameterOrder": [ "parent" ], "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/policyBindings:searchTargetPolicyBindings", "id": "iam.organizations.locations.policyBindings.searchTargetPolicyBindings", "description": "Search policy bindings by target. Returns all policy binding objects bound directly to target.", "path": "v3beta/{+parent}/policyBindings:searchTargetPolicyBindings" }, "delete": { "flatPath": "v3beta/organizations/{organizationsId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "parameterOrder": [ "name" ], "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" }, "id": "iam.organizations.locations.policyBindings.delete", "path": "v3beta/{+name}", "httpMethod": "DELETE", "parameters": { "validateOnly": { "location": "query", "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it.", "type": "boolean" }, "name": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "type": "string", "description": "Required. The name of the policy binding to delete. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "location": "path" }, "etag": { "type": "string", "description": "Optional. The etag of the policy binding. If this is provided, it must match the server's etag.", "location": "query" } }, "description": "Deletes a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is deleted, the policy no longer applies to the target." } } } } } } }, "projects": { "resources": { "locations": { "resources": { "accessPolicies": { "methods": { "get": { "path": "v3beta/{+name}", "description": "Gets an access policy.", "id": "iam.projects.locations.accessPolicies.get", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleIamV3betaAccessPolicy" }, "httpMethod": "GET", "parameters": { "name": { "pattern": "^projects/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "location": "path", "required": true, "type": "string", "description": "Required. The name of the access policy to retrieve. Format: `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`" } }, "parameterOrder": [ "name" ] }, "patch": { "httpMethod": "PATCH", "parameters": { "name": { "location": "path", "pattern": "^projects/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "required": true, "type": "string", "description": "Identifier. The resource name of the access policy. The following formats are supported: * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`" }, "validateOnly": { "description": "Optional. If set, validate the request and preview the update, but do not actually post it.", "location": "query", "type": "boolean" } }, "response": { "$ref": "GoogleLongrunningOperation" }, "request": { "$ref": "GoogleIamV3betaAccessPolicy" }, "path": "v3beta/{+name}", "parameterOrder": [ "name" ], "id": "iam.projects.locations.accessPolicies.patch", "description": "Updates an access policy.", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "list": { "parameterOrder": [ "parent" ], "httpMethod": "GET", "parameters": { "filter": { "type": "string", "location": "query", "description": "Optional. An expression for filtering the results of the request. Example filter query: `display_name:example*` matches access policies whose display name starts with \"example\"." }, "parent": { "location": "path", "description": "Required. The parent resource, which owns the collection of access policy resources. Format: `projects/{project_id}/locations/{location}` `projects/{project_number}/locations/{location}` `folders/{folder_id}/locations/{location}` `organizations/{organization_id}/locations/{location}`", "type": "string", "pattern": "^projects/[^/]+/locations/[^/]+$", "required": true }, "pageSize": { "description": "Optional. The maximum number of access policies to return. The service may return fewer than this value. If unspecified, at most 50 access policies will be returned. Valid value ranges from 1 to 1000; values above 1000 will be coerced to 1000.", "location": "query", "format": "int32", "type": "integer" }, "pageToken": { "type": "string", "description": "Optional. A page token, received from a previous `ListAccessPolicies` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListAccessPolicies` must match the call that provided the page token.", "location": "query" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleIamV3betaListAccessPoliciesResponse" }, "path": "v3beta/{+parent}/accessPolicies", "description": "Lists access policies.", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/accessPolicies", "id": "iam.projects.locations.accessPolicies.list" }, "create": { "request": { "$ref": "GoogleIamV3betaAccessPolicy" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" }, "description": "Creates an access policy, and returns a long running operation.", "path": "v3beta/{+parent}/accessPolicies", "httpMethod": "POST", "parameters": { "parent": { "type": "string", "pattern": "^projects/[^/]+/locations/[^/]+$", "location": "path", "description": "Required. The parent resource where this access policy will be created. Format: `projects/{project_id}/locations/{location}` `projects/{project_number}/locations/{location}` `folders/{folder_id}/locations/{location}` `organizations/{organization_id}/locations/{location}`", "required": true }, "validateOnly": { "location": "query", "type": "boolean", "description": "Optional. If set, validate the request and preview the creation, but do not actually post it." }, "accessPolicyId": { "description": "Required. The ID to use for the access policy, which will become the final component of the access policy's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/. This value must be unique among all access policies with the same parent.", "location": "query", "type": "string" } }, "parameterOrder": [ "parent" ], "id": "iam.projects.locations.accessPolicies.create", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/accessPolicies" }, "searchPolicyBindings": { "response": { "$ref": "GoogleIamV3betaSearchAccessPolicyBindingsResponse" }, "parameterOrder": [ "name" ], "description": "Returns all policy bindings that bind a specific policy if a user has searchPolicyBindings permission on that policy.", "path": "v3beta/{+name}:searchPolicyBindings", "id": "iam.projects.locations.accessPolicies.searchPolicyBindings", "httpMethod": "GET", "parameters": { "pageToken": { "type": "string", "description": "Optional. A page token, received from a previous `SearchAccessPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchAccessPolicyBindingsRequest` must match the call that provided the page token.", "location": "query" }, "pageSize": { "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. If unspecified, at most 50 policy bindings will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.", "format": "int32", "type": "integer", "location": "query" }, "name": { "required": true, "type": "string", "pattern": "^projects/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "description": "Required. The name of the access policy. Format: `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`", "location": "path" } }, "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}:searchPolicyBindings", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "delete": { "id": "iam.projects.locations.accessPolicies.delete", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "path": "v3beta/{+name}", "response": { "$ref": "GoogleLongrunningOperation" }, "httpMethod": "DELETE", "parameters": { "name": { "type": "string", "location": "path", "pattern": "^projects/[^/]+/locations/[^/]+/accessPolicies/[^/]+$", "description": "Required. The name of the access policy to delete. Format: `projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}` `folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}` `organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`", "required": true }, "etag": { "description": "Optional. The etag of the access policy. If this is provided, it must match the server's etag.", "location": "query", "type": "string" }, "validateOnly": { "type": "boolean", "location": "query", "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it." }, "force": { "location": "query", "type": "boolean", "description": "Optional. If set to true, the request will force the deletion of the Policy even if the Policy references PolicyBindings." } }, "description": "Deletes an access policy.", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/accessPolicies/{accessPoliciesId}" } } }, "operations": { "methods": { "get": { "path": "v3beta/{+name}", "id": "iam.projects.locations.operations.get", "parameterOrder": [ "name" ], "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/operations/{operationsId}", "description": "Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.", "httpMethod": "GET", "parameters": { "name": { "required": true, "description": "The name of the operation resource.", "type": "string", "pattern": "^projects/[^/]+/locations/[^/]+/operations/[^/]+$", "location": "path" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" } } } }, "policyBindings": { "methods": { "list": { "description": "Lists policy bindings.", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/policyBindings", "id": "iam.projects.locations.policyBindings.list", "httpMethod": "GET", "parameters": { "pageToken": { "type": "string", "location": "query", "description": "Optional. A page token, received from a previous `ListPolicyBindings` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListPolicyBindings` must match the call that provided the page token." }, "parent": { "pattern": "^projects/[^/]+/locations/[^/]+$", "location": "path", "type": "string", "description": "Required. The parent resource, which owns the collection of policy bindings. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "required": true }, "pageSize": { "location": "query", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000.", "type": "integer", "format": "int32" }, "filter": { "description": "Optional. An expression for filtering the results of the request. Filter rules are case insensitive. Some eligible fields for filtering are the following: + `target` + `policy` Some examples of filter queries: * `target:ex*`: The binding target's name starts with \"ex\". * `target:example`: The binding target's name is `example`. * `policy:example`: The binding policy's name is `example`.", "type": "string", "location": "query" } }, "response": { "$ref": "GoogleIamV3betaListPolicyBindingsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "parent" ], "path": "v3beta/{+parent}/policyBindings" }, "create": { "httpMethod": "POST", "parameters": { "validateOnly": { "location": "query", "description": "Optional. If set, validate the request and preview the creation, but do not actually post it.", "type": "boolean" }, "policyBindingId": { "type": "string", "description": "Required. The ID to use for the policy binding, which will become the final component of the policy binding's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/.", "location": "query" }, "parent": { "required": true, "pattern": "^projects/[^/]+/locations/[^/]+$", "description": "Required. The parent resource where this policy binding will be created. The binding parent is the closest Resource Manager resource (project, folder or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "location": "path", "type": "string" } }, "description": "Creates a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is created, the policy is applied to the target.", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/policyBindings", "parameterOrder": [ "parent" ], "request": { "$ref": "GoogleIamV3betaPolicyBinding" }, "id": "iam.projects.locations.policyBindings.create", "path": "v3beta/{+parent}/policyBindings", "response": { "$ref": "GoogleLongrunningOperation" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "delete": { "id": "iam.projects.locations.policyBindings.delete", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "httpMethod": "DELETE", "parameters": { "validateOnly": { "description": "Optional. If set, validate the request and preview the deletion, but do not actually post it.", "location": "query", "type": "boolean" }, "name": { "type": "string", "description": "Required. The name of the policy binding to delete. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "required": true, "pattern": "^projects/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "location": "path" }, "etag": { "type": "string", "location": "query", "description": "Optional. The etag of the policy binding. If this is provided, it must match the server's etag." } }, "path": "v3beta/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" }, "description": "Deletes a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is deleted, the policy no longer applies to the target.", "parameterOrder": [ "name" ] }, "searchTargetPolicyBindings": { "path": "v3beta/{+parent}/policyBindings:searchTargetPolicyBindings", "description": "Search policy bindings by target. Returns all policy binding objects bound directly to target.", "parameterOrder": [ "parent" ], "response": { "$ref": "GoogleIamV3betaSearchTargetPolicyBindingsResponse" }, "httpMethod": "GET", "parameters": { "pageToken": { "location": "query", "description": "Optional. A page token, received from a previous `SearchTargetPolicyBindingsRequest` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `SearchTargetPolicyBindingsRequest` must match the call that provided the page token.", "type": "string" }, "parent": { "required": true, "type": "string", "description": "Required. The parent resource where this search will be performed. This should be the nearest Resource Manager resource (project, folder, or organization) to the target. Format: * `projects/{project_id}/locations/{location}` * `projects/{project_number}/locations/{location}` * `folders/{folder_id}/locations/{location}` * `organizations/{organization_id}/locations/{location}`", "location": "path", "pattern": "^projects/[^/]+/locations/[^/]+$" }, "pageSize": { "location": "query", "type": "integer", "format": "int32", "description": "Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000." }, "filter": { "description": "Optional. Filtering currently only supports the kind of policies to return, and must be in the format \"policy_kind={policy_kind}\". If String is empty, bindings bound to all kinds of policies would be returned. The only supported values are the following: * \"policy_kind=PRINCIPAL_ACCESS_BOUNDARY\", * \"policy_kind=ACCESS\"", "location": "query", "type": "string" }, "target": { "description": "Required. The target resource, which is bound to the policy in the binding. Format: * `//iam.googleapis.com/locations/global/workforcePools/POOL_ID` * `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID` * `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID` * `//cloudresourcemanager.googleapis.com/projects/{project_number}` * `//cloudresourcemanager.googleapis.com/folders/{folder_id}` * `//cloudresourcemanager.googleapis.com/organizations/{organization_id}`", "type": "string", "location": "query" } }, "id": "iam.projects.locations.policyBindings.searchTargetPolicyBindings", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/policyBindings:searchTargetPolicyBindings", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "patch": { "response": { "$ref": "GoogleLongrunningOperation" }, "id": "iam.projects.locations.policyBindings.patch", "description": "Updates a policy binding and returns a long-running operation. Callers will need the IAM permissions on the policy and target in the binding to update. Target and policy are immutable and cannot be updated.", "httpMethod": "PATCH", "parameters": { "name": { "pattern": "^projects/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "location": "path", "type": "string", "required": true, "description": "Identifier. The name of the policy binding, in the format `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`. The binding parent is the closest Resource Manager resource (project, folder, or organization) to the binding target. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`" }, "updateMask": { "type": "string", "location": "query", "description": "Optional. The list of fields to update", "format": "google-fieldmask" }, "validateOnly": { "location": "query", "description": "Optional. If set, validate the request and preview the update, but do not actually post it.", "type": "boolean" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "request": { "$ref": "GoogleIamV3betaPolicyBinding" }, "path": "v3beta/{+name}", "parameterOrder": [ "name" ] }, "get": { "parameterOrder": [ "name" ], "description": "Gets a policy binding.", "flatPath": "v3beta/projects/{projectsId}/locations/{locationsId}/policyBindings/{policyBindingsId}", "httpMethod": "GET", "parameters": { "name": { "required": true, "pattern": "^projects/[^/]+/locations/[^/]+/policyBindings/[^/]+$", "type": "string", "description": "Required. The name of the policy binding to retrieve. Format: * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}` * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}` * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`", "location": "path" } }, "id": "iam.projects.locations.policyBindings.get", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleIamV3betaPolicyBinding" }, "path": "v3beta/{+name}" } } } } } } } }, "discoveryVersion": "v1", "name": "iam", "protocol": "rest", "rootUrl": "https://iam.googleapis.com/", "baseUrl": "https://iam.googleapis.com/", "version": "v3beta", "icons": { "x16": "http://www.google.com/images/icons/product/search-16.gif", "x32": "http://www.google.com/images/icons/product/search-32.gif" }, "title": "Identity and Access Management (IAM) API", "ownerDomain": "google.com", "basePath": "" }