=H S r SSKJr SSKJr SSKJr SSKJr Sr " S S\R 5 r " S S
\R 5 r " S S \R 5 r
" S
S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S \R 5 r " S S \R 5 r " S S \R 5 r " S! S"\R 5 r " S# S$\R 5 r " S% S&\R 5 r " S' S(\R 5 r " S) S*\R 5 r " S+ S,\R 5 r " S- S.\R 5 r " S/ S0\R 5 r " S1 S2\R 5 r " S3 S4\R 5 r! " S5 S6\R 5 r" " S7 S8\R 5 r# " S9 S:\R 5 r$ " S; S<\R 5 r% " S= S>\R 5 r& " S? S@\R 5 r' " SA SB\R 5 r( " SC SD\R 5 r) " SE SF\R 5 r* " SG SH\R 5 r+ " SI SJ\R 5 r, " SK SL\R 5 r- " SM SN\R 5 r. " SO SP\R 5 r/ " SQ SR\R 5 r0 " SS ST\R 5 r1 " SU SV\R 5 r2 " SW SX\R 5 r3 " SY SZ\R 5 r4 " S[ S\\R 5 r5 " S] S^\R 5 r6 " S_ S`\R 5 r7 " Sa Sb\R 5 r8 " Sc Sd\R 5 r9 " Se Sf\R 5 r: " Sg Sh\R 5 r; " Si Sj\R 5 r< " Sk Sl\R 5 r= " Sm Sn\R 5 r> " So Sp\R 5 r? " Sq Sr\R 5 r@ " Ss St\R 5 rA " Su Sv\R 5 rB " Sw Sx\R 5 rC " Sy Sz\R 5 rD " S{ S|\R 5 rE " S} S~\R 5 rF " S S\R 5 rG " S S\R 5 rH " S S\R 5 rI " S S\R 5 rJ " S S\R 5 rK " S S\R 5 rL " S S\R 5 rM " S S\R 5 rN " S S\R 5 rO " S S\R 5 rP " S S\R 5 rQ " S S\R 5 rR " S S\R 5 rS " S S\R 5 rT " S S\R 5 rU " S S\R 5 rV " S S\R 5 rW " S S\R 5 rX " S S\R 5 rY " S S\R 5 rZ " S S\R 5 r[ " S S\R 5 r\ " S S\R 5 r] " S S\R 5 r^ " S S\R 5 r_ " S S\R 5 r` " S S\R 5 ra " S S\R 5 rb " S S\R 5 rc " S S\R 5 rd " S S\R 5 re " S S\R 5 rf " S S\R 5 rg " S S\R 5 rh " S S\R 5 ri " S S\R 5 rj " S S\R 5 rk " S S\R 5 rl " S S\R 5 rm " S S\R 5 rn " S S\R 5 ro " S S\R 5 rp " S S\R 5 rq " S S\R 5 rr " S S\R 5 rs " S S\R 5 rt " S S\R 5 ru " S S\R 5 rv " S S\R 5 rw " S S\R 5 rx " S S\R 5 ry " S S\R 5 rz " S S\R 5 r{ " S S\R 5 r| " S S\R 5 r} " S S\R 5 r~ " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S GS \R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS
\R 5 r " GS GS \R 5 r " GS
GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r\GR( " \GSGS5 \GR* " \GR, GSGS 5 \GR* " \GR, GS GS 5 \GR( " \ GS GS 5 \GR( " \!GS GS 5 \GR( " \HGS GS 5 \GR( " \AGS GS 5 \GR( " \KGS GS 5 Gg!(" zGenerated message classes for cloudkms version v1.
Manages keys and performs cryptographic operations in a central cloud service,
for direct use by other cloud resources and applications.
)absolute_import)messages)encoding) extra_typescloudkmsc ` \ rS rSrSr\R " S5 r\R " S5 r Sr
g)AsymmetricDecryptRequest a7 Request message for KeyManagementService.AsymmetricDecrypt.
Fields:
ciphertext: Required. The data encrypted with the named CryptoKeyVersion's
public key using OAEP.
ciphertextCrc32c: Optional. An optional CRC32C checksum of the
AsymmetricDecryptRequest.ciphertext. If specified, KeyManagementService
will verify the integrity of the received
AsymmetricDecryptRequest.ciphertext using this checksum.
KeyManagementService will report an error if the checksum verification
fails. If you receive a checksum error, your client should verify that
CRC32C(AsymmetricDecryptRequest.ciphertext) is equal to
AsymmetricDecryptRequest.ciphertext_crc32c, and if so, perform a limited
number of retries. A persistent mismatch may indicate an issue in your
computation of the CRC32C checksum. Note: This field is defined as int64
for reasons of compatibility across different languages. However, it is
a non-negative integer, which will never exceed 2^32-1, and can be
safely downconverted to uint32 in languages that support this type.
N __name__
__module__ __qualname____firstlineno____doc__ _messages
BytesField
ciphertext IntegerFieldciphertextCrc32c__static_attributes__r
Mlib/googlecloudsdk/generated_clients/apis/cloudkms/v1/cloudkms_v1_messages.pyr r s* ( ##A&* ++A.r r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r \R " SS5 r
\R " S5 rS rg
) AsymmetricDecryptResponse+ a Response message for KeyManagementService.AsymmetricDecrypt.
Enums:
ProtectionLevelValueValuesEnum: The ProtectionLevel of the
CryptoKeyVersion used in decryption.
Fields:
plaintext: The decrypted data originally encrypted with the matching
public key.
plaintextCrc32c: Integrity verification field. A CRC32C checksum of the
returned AsymmetricDecryptResponse.plaintext. An integrity check of
AsymmetricDecryptResponse.plaintext can be performed by computing the
CRC32C checksum of AsymmetricDecryptResponse.plaintext and comparing
your results to this field. Discard the response in case of non-matching
checksum values, and perform a limited number of retries. A persistent
mismatch may indicate an issue in your computation of the CRC32C
checksum. Note: This field is defined as int64 for reasons of
compatibility across different languages. However, it is a non-negative
integer, which will never exceed 2^32-1, and can be safely downconverted
to uint32 in languages that support this type.
protectionLevel: The ProtectionLevel of the CryptoKeyVersion used in
decryption.
verifiedCiphertextCrc32c: Integrity verification field. A flag indicating
whether AsymmetricDecryptRequest.ciphertext_crc32c was received by
KeyManagementService and used for the integrity verification of the
ciphertext. A false value of this field indicates either that
AsymmetricDecryptRequest.ciphertext_crc32c was left unset or that it was
not delivered to KeyManagementService. If you've set
AsymmetricDecryptRequest.ciphertext_crc32c but this field is still
false, discard the response and perform a limited number of retries.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
8AsymmetricDecryptResponse.ProtectionLevelValueValuesEnumL The ProtectionLevel of the CryptoKeyVersion used in decryption.
Values:
PROTECTION_LEVEL_UNSPECIFIED: Not specified.
SOFTWARE: Crypto operations are performed in software.
HSM: Crypto operations are performed in a Hardware Security Module.
EXTERNAL: Crypto operations are performed by an external key manager.
EXTERNAL_VPC: Crypto operations are performed in an EKM-over-VPC
backend.
r r r r
N r r r r r PROTECTION_LEVEL_UNSPECIFIEDSOFTWAREHSMEXTERNAL EXTERNAL_VPCr r
r r ProtectionLevelValueValuesEnumr L # $% H
CHLr r+ r r r# r$ r
N)r r r r r r Enumr+ r plaintextr plaintextCrc32c EnumFieldprotectionLevel BooleanFieldverifiedCiphertextCrc32cr r
r r r r + s^ @y~~ " ""1%) **1-/ ''(H!L/ & 3 3A 6r r c \ rS rSrSr\R " S5 r\R " S5 r \R " SS5 r \R " S5 r Sr
g )
AsymmetricSignRequestc a` Request message for KeyManagementService.AsymmetricSign.
Fields:
data: Optional. The data to sign. It can't be supplied if
AsymmetricSignRequest.digest is supplied.
dataCrc32c: Optional. An optional CRC32C checksum of the
AsymmetricSignRequest.data. If specified, KeyManagementService will
verify the integrity of the received AsymmetricSignRequest.data using
this checksum. KeyManagementService will report an error if the checksum
verification fails. If you receive a checksum error, your client should
verify that CRC32C(AsymmetricSignRequest.data) is equal to
AsymmetricSignRequest.data_crc32c, and if so, perform a limited number
of retries. A persistent mismatch may indicate an issue in your
computation of the CRC32C checksum. Note: This field is defined as int64
for reasons of compatibility across different languages. However, it is
a non-negative integer, which will never exceed 2^32-1, and can be
safely downconverted to uint32 in languages that support this type.
digest: Optional. The digest of the data to sign. The digest must be
produced with the same digest algorithm as specified by the key
version's algorithm. This field may not be supplied if
AsymmetricSignRequest.data is supplied.
digestCrc32c: Optional. An optional CRC32C checksum of the
AsymmetricSignRequest.digest. If specified, KeyManagementService will
verify the integrity of the received AsymmetricSignRequest.digest using
this checksum. KeyManagementService will report an error if the checksum
verification fails. If you receive a checksum error, your client should
verify that CRC32C(AsymmetricSignRequest.digest) is equal to
AsymmetricSignRequest.digest_crc32c, and if so, perform a limited number
of retries. A persistent mismatch may indicate an issue in your
computation of the CRC32C checksum. Note: This field is defined as int64
for reasons of compatibility across different languages. However, it is
a non-negative integer, which will never exceed 2^32-1, and can be
safely downconverted to uint32 in languages that support this type.
r r Digestr# r$ r
N)r r r r r r r datar
dataCrc32c MessageFielddigest digestCrc32cr r
r r r5 r5 c sL !F
a $%%a(* ! !(A .&''*,r r5 c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r \R " S5 r
\R " S5 r\R " S 5 r\R " S
5 rS rg )
AsymmetricSignResponse a Response message for KeyManagementService.AsymmetricSign.
Enums:
ProtectionLevelValueValuesEnum: The ProtectionLevel of the
CryptoKeyVersion used for signing.
Fields:
name: The resource name of the CryptoKeyVersion used for signing. Check
this field to verify that the intended resource was used for signing.
protectionLevel: The ProtectionLevel of the CryptoKeyVersion used for
signing.
signature: The created signature.
signatureCrc32c: Integrity verification field. A CRC32C checksum of the
returned AsymmetricSignResponse.signature. An integrity check of
AsymmetricSignResponse.signature can be performed by computing the
CRC32C checksum of AsymmetricSignResponse.signature and comparing your
results to this field. Discard the response in case of non-matching
checksum values, and perform a limited number of retries. A persistent
mismatch may indicate an issue in your computation of the CRC32C
checksum. Note: This field is defined as int64 for reasons of
compatibility across different languages. However, it is a non-negative
integer, which will never exceed 2^32-1, and can be safely downconverted
to uint32 in languages that support this type.
verifiedDataCrc32c: Integrity verification field. A flag indicating
whether AsymmetricSignRequest.data_crc32c was received by
KeyManagementService and used for the integrity verification of the
data. A false value of this field indicates either that
AsymmetricSignRequest.data_crc32c was left unset or that it was not
delivered to KeyManagementService. If you've set
AsymmetricSignRequest.data_crc32c but this field is still false, discard
the response and perform a limited number of retries.
verifiedDigestCrc32c: Integrity verification field. A flag indicating
whether AsymmetricSignRequest.digest_crc32c was received by
KeyManagementService and used for the integrity verification of the
digest. A false value of this field indicates either that
AsymmetricSignRequest.digest_crc32c was left unset or that it was not
delivered to KeyManagementService. If you've set
AsymmetricSignRequest.digest_crc32c but this field is still false,
discard the response and perform a limited number of retries.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
5AsymmetricSignResponse.ProtectionLevelValueValuesEnum The ProtectionLevel of the CryptoKeyVersion used for signing.
Values:
PROTECTION_LEVEL_UNSPECIFIED: Not specified.
SOFTWARE: Crypto operations are performed in software.
HSM: Crypto operations are performed in a Hardware Security Module.
EXTERNAL: Crypto operations are performed by an external key manager.
EXTERNAL_VPC: Crypto operations are performed in an EKM-over-VPC
backend.
r r r r# r$ r
Nr% r
r r r+ rA r, r r+ r r r# r$ r
N)r r r r r r r- r+ StringFieldnamer0 r1 r signaturer signatureCrc32cr2 verifiedDataCrc32cverifiedDigestCrc32cr r
r r r> r> s 'Ry~~ "
q !$ ''(H!L/""1%) **1-/ --a0"//2r r> c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
AuditConfig aw Specifies the audit configuration for a service. The configuration
determines which permission types are logged, and what identities, if any,
are exempted from logging. An AuditConfig must have one or more
AuditLogConfigs. If there are AuditConfigs for both `allServices` and a
specific service, the union of the two AuditConfigs is used for that
service: the log_types specified in each AuditConfig are enabled, and the
exempted_members in each AuditLogConfig are exempted. Example Policy with
multiple AuditConfigs: { "audit_configs": [ { "service": "allServices",
"audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
"user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type":
"ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com",
"audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type":
"DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For
sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
logging. It also exempts `jose@example.com` from DATA_READ logging, and
`aliya@example.com` from DATA_WRITE logging.
Fields:
auditLogConfigs: The configuration for logging of each type of permission.
service: Specifies a service that will be enabled for audit logging. For
example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
`allServices` is a special value that covers all services.
AuditLogConfigr Trepeatedr r
N) r r r r r r r: auditLogConfigsrF servicer r
r r rM rM s. 0 **+;QN/ ! !! $'r rM c \ rS rSrSr " S S\R 5 r\R " SSS9r \R " SS5 r S r g
) rO aR Provides the configuration for logging a type of permissions. Example: {
"audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
"user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables
'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from
DATA_READ logging.
Enums:
LogTypeValueValuesEnum: The log type that this config enables.
Fields:
exemptedMembers: Specifies the identities that do not cause logging for
this type of permission. Follows the same format of Binding.members.
logType: The log type that this config enables.
c ( \ rS rSrSrSrSrSrSrSr g) %AuditLogConfig.LogTypeValueValuesEnum a The log type that this config enables.
Values:
LOG_TYPE_UNSPECIFIED: Default case. Should never be this.
ADMIN_READ: Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE: Data writes. Example: CloudSQL Users create
DATA_READ: Data reads. Example: CloudSQL Users list
r r r r# r
N)
r r r r r LOG_TYPE_UNSPECIFIED
ADMIN_READ
DATA_WRITE DATA_READr r
r r LogTypeValueValuesEnumrW s JJIr r] r TrP r r
N)
r r r r r r r- r] rF exemptedMembersr0 logTyper r
r r rO rO s>
y~~ ))!d;/ 8! <'r rO c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S5 r \R " SS5 r
S rg
)
AutokeyConfigi a Cloud KMS Autokey configuration for a folder or project.
Enums:
StateValueValuesEnum: Output only. The state for the AutokeyConfig.
Fields:
etag: Optional. A checksum computed by the server based on the value of
other fields. This may be sent on update requests to ensure that the
client has an up-to-date value before proceeding. The request will be
rejected with an ABORTED error on a mismatched etag.
keyProject: Optional. Name of the key project, e.g.
`projects/{PROJECT_ID}` or `projects/{PROJECT_NUMBER}`, where Cloud KMS
Autokey will provision a new CryptoKey when a KeyHandle is created. On
UpdateAutokeyConfig, the caller will require
`cloudkms.cryptoKeys.setIamPolicy` permission on this key project. Once
configured, for Cloud KMS Autokey to function properly, this key project
must have the Cloud KMS API activated and the Cloud KMS Service Agent
for this key project must be granted the `cloudkms.admin` role (or
pertinent permissions). A request with an empty key project field will
clear the configuration.
name: Identifier. Name of the AutokeyConfig resource, e.g.
`folders/{FOLDER_NUMBER}/autokeyConfig`
`projects/{PROJECT_NUMBER}/autokeyConfig`.
state: Output only. The state for the AutokeyConfig.
c ( \ rS rSrSrSrSrSrSrSr g) "AutokeyConfig.StateValueValuesEnumi* a Output only. The state for the AutokeyConfig.
Values:
STATE_UNSPECIFIED: The state of the AutokeyConfig is unspecified.
ACTIVE: The AutokeyConfig is currently active.
KEY_PROJECT_DELETED: A previously configured key project has been
deleted and the current AutokeyConfig is unusable.
UNINITIALIZED: The AutokeyConfig is not yet initialized or has been
reset to its default uninitialized state.
r r r r# r
N)
r r r r r STATE_UNSPECIFIEDACTIVEKEY_PROJECT_DELETED
UNINITIALIZEDr r
r r StateValueValuesEnumrc * s
FMr rh r r r# r$ r
N)r r r r r r r- rh rF etag
keyProjectrG r0 stater r
r r ra ra s\ 4Y^^
q !$$$Q'* q !$
4a
8%r ra c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) Bindingi@ at Associates `members`, or principals, with a `role`.
Fields:
condition: The condition that is associated with this binding. If the
condition evaluates to `true`, then this binding applies to the current
request. If the condition evaluates to `false`, then this binding does
not apply to the current request. However, a different role binding
might grant the same role to one or more of the principals in this
binding. To learn which resources support conditions in their IAM
policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
members: Specifies the principals requesting access for a Google Cloud
resource. `members` can have the following values: * `allUsers`: A
special identifier that represents anyone who is on the internet; with
or without a Google account. * `allAuthenticatedUsers`: A special
identifier that represents anyone who is authenticated with a Google
account or a service account. Does not include identities that come from
external identity providers (IdPs) through identity federation. *
`user:{emailid}`: An email address that represents a specific Google
account. For example, `alice@example.com` . *
`serviceAccount:{emailid}`: An email address that represents a Google
service account. For example, `my-other-
app@appspot.gserviceaccount.com`. *
`serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`:
An identifier for a [Kubernetes service
account](https://cloud.google.com/kubernetes-engine/docs/how-
to/kubernetes-service-accounts). For example, `my-
project.svc.id.goog[my-namespace/my-kubernetes-sa]`. *
`group:{emailid}`: An email address that represents a Google group. For
example, `admins@example.com`. * `domain:{domain}`: The G Suite domain
(primary) that represents all the users of that domain. For example,
`google.com` or `example.com`. * `principal://iam.googleapis.com/locatio
ns/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A
single identity in a workforce identity pool. * `principalSet://iam.goog
leapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`:
All workforce identities in a group. * `principalSet://iam.googleapis.co
m/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{
attribute_value}`: All workforce identities with a specific attribute
value. * `principalSet://iam.googleapis.com/locations/global/workforcePo
ols/{pool_id}/*`: All identities in a workforce identity pool. * `princi
pal://iam.googleapis.com/projects/{project_number}/locations/global/work
loadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single
identity in a workload identity pool. * `principalSet://iam.googleapis.c
om/projects/{project_number}/locations/global/workloadIdentityPools/{poo
l_id}/group/{group_id}`: A workload identity pool group. * `principalSet
://iam.googleapis.com/projects/{project_number}/locations/global/workloa
dIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
All identities in a workload identity pool with a certain attribute. * `
principalSet://iam.googleapis.com/projects/{project_number}/locations/gl
obal/workloadIdentityPools/{pool_id}/*`: All identities in a workload
identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email
address (plus unique identifier) representing a user that has been
recently deleted. For example,
`alice@example.com?uid=123456789012345678901`. If the user is recovered,
this value reverts to `user:{emailid}` and the recovered user retains
the role in the binding. *
`deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address
(plus unique identifier) representing a service account that has been
recently deleted. For example, `my-other-
app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the
service account is undeleted, this value reverts to
`serviceAccount:{emailid}` and the undeleted service account retains the
role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An
email address (plus unique identifier) representing a Google group that
has been recently deleted. For example,
`admins@example.com?uid=123456789012345678901`. If the group is
recovered, this value reverts to `group:{emailid}` and the recovered
group retains the role in the binding. * `deleted:principal://iam.google
apis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attr
ibute_value}`: Deleted single identity in a workforce identity pool. For
example, `deleted:principal://iam.googleapis.com/locations/global/workfo
rcePools/my-pool-id/subject/my-subject-attribute-value`.
role: Role that is assigned to the list of `members`, or principals. For
example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an
overview of the IAM roles and permissions, see the [IAM
documentation](https://cloud.google.com/iam/docs/roles-overview). For a
list of the available pre-defined roles, see
[here](https://cloud.google.com/iam/docs/understanding-roles).
Exprr r TrP r# r
N) r r r r r r r: conditionrF membersroler r
r r rm rm @ s? Ob $$VQ/) ! !!d 3' q !$r rm c Z \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r \R " S5 r
\R " S5 r\R " S 5 r\R " S
5 r\R " S S S
9rSrg) Certificatei a
A Certificate represents an X.509 certificate used to authenticate HTTPS
connections to EKM replicas.
Fields:
issuer: Output only. The issuer distinguished name in RFC 2253 format.
Only present if parsed is true.
notAfterTime: Output only. The certificate is not valid after this time.
Only present if parsed is true.
notBeforeTime: Output only. The certificate is not valid before this time.
Only present if parsed is true.
parsed: Output only. True if the certificate was parsed successfully.
rawDer: Required. The raw certificate bytes in DER format.
serialNumber: Output only. The certificate serial number as a hex string.
Only present if parsed is true.
sha256Fingerprint: Output only. The SHA-256 certificate fingerprint as a
hex string. Only present if parsed is true.
subject: Output only. The subject distinguished name in RFC 2253 format.
Only present if parsed is true.
subjectAlternativeDnsNames: Output only. The subject Alternative DNS
names. Only present if parsed is true.
r r r# r$ rD rE TrP r
N)r r r r r r rF issuer notAfterTime
notBeforeTimer2 parsedr rawDer serialNumbersha256FingerprintsubjectsubjectAlternativeDnsNamesr r
r r rs rs s , #&&&q),''*- ! !! $& "&&&q), ++A. ! !! $' ( 4 4Q F r rs c ~ \ rS rSrSr\R " SSS9r\R " SSS9r\R " SSS9r Sr
g )
CertificateChainsi a Certificate chains needed to verify the attestation. Certificates in
chains are PEM-encoded and are ordered based on
https://tools.ietf.org/html/rfc5246#section-7.4.2.
Fields:
caviumCerts: Cavium certificate chain corresponding to the attestation.
googleCardCerts: Google card certificate chain corresponding to the
attestation.
googlePartitionCerts: Google partition certificate chain corresponding to
the attestation.
r TrP r r# r
N) r r r r r r rF caviumCertsgoogleCardCertsgooglePartitionCertsr r
r r r r s@
%%a$7+ ))!d;/"..q4@r r c ` \ rS rSrSr\R " S5 r\R " S5 r Sr
g)ChecksummedDatai a' Data with integrity verification field.
Fields:
crc32cChecksum: Integrity verification field. A CRC32C checksum of the
returned ChecksummedData.data. An integrity check of
ChecksummedData.data can be performed by computing the CRC32C checksum
of ChecksummedData.data and comparing your results to this field.
Discard the response in case of non-matching checksum values, and
perform a limited number of retries. A persistent mismatch may indicate
an issue in your computation of the CRC32C checksum. Note: This field is
defined as int64 for reasons of compatibility across different
languages. However, it is a non-negative integer, which will never
exceed `2^32-1`, and can be safely downconverted to uint32 in languages
that support this type.
data: Raw Data.
r r r
N) r r r r r r r crc32cChecksumr r8 r r
r r r r s) " ))!,. a $r r c : \ rS rSrSr\R " SSS9rSrg)&CloudkmsFoldersGetAutokeyConfigRequesti zA CloudkmsFoldersGetAutokeyConfigRequest object.
Fields:
name: Required. Name of the AutokeyConfig resource, e.g.
`folders/{FOLDER_NUMBER}/autokeyConfig`.
r Trequiredr
N r r r r r r rF rG r r
r r r r
q4 0$r r c : \ rS rSrSr\R " SSS9rSrg)(CloudkmsFoldersGetKajPolicyConfigRequesti zA CloudkmsFoldersGetKajPolicyConfigRequest object.
Fields:
name: Required. The name of the KeyAccessJustificationsPolicyConfig to
get.
r Tr r
Nr r
r r r r r r r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) )CloudkmsFoldersUpdateAutokeyConfigRequesti a A CloudkmsFoldersUpdateAutokeyConfigRequest object.
Fields:
autokeyConfig: A AutokeyConfig resource to be passed as the request body.
name: Identifier. Name of the AutokeyConfig resource, e.g.
`folders/{FOLDER_NUMBER}/autokeyConfig`
`projects/{PROJECT_NUMBER}/autokeyConfig`.
updateMask: Required. Masks which fields of the AutokeyConfig to update,
e.g. `keyProject`.
ra r r Tr r# r
N) r r r r r r r:
autokeyConfigrF rG
updateMaskr r
r r r r s= (( !<- q4 0$$$Q'*r r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) +CloudkmsFoldersUpdateKajPolicyConfigRequesti a A CloudkmsFoldersUpdateKajPolicyConfigRequest object.
Fields:
keyAccessJustificationsPolicyConfig: A KeyAccessJustificationsPolicyConfig
resource to be passed as the request body.
name: Identifier. The resource name for this
KeyAccessJustificationsPolicyConfig in the format of
"{organizations|folders|projects}/*/kajPolicyConfig".
updateMask: Optional. The list of fields to update.
#KeyAccessJustificationsPolicyConfigr r Tr r# r
N r r r r r r r: #keyAccessJustificationsPolicyConfigrF rG r r r
r r r r @ )2(>(>?dfg(h% q4 0$$$Q'*r r c : \ rS rSrSr\R " SSS9rSrg).CloudkmsOrganizationsGetKajPolicyConfigRequesti zA CloudkmsOrganizationsGetKajPolicyConfigRequest object.
Fields:
name: Required. The name of the KeyAccessJustificationsPolicyConfig to
get.
r Tr r
Nr r
r r r r r r r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 1CloudkmsOrganizationsUpdateKajPolicyConfigRequesti$ a A CloudkmsOrganizationsUpdateKajPolicyConfigRequest object.
Fields:
keyAccessJustificationsPolicyConfig: A KeyAccessJustificationsPolicyConfig
resource to be passed as the request body.
name: Identifier. The resource name for this
KeyAccessJustificationsPolicyConfig in the format of
"{organizations|folders|projects}/*/kajPolicyConfig".
updateMask: Optional. The list of fields to update.
r r r Tr r# r
Nr r
r r r r $ r r r c : \ rS rSrSr\R " SSS9rSrg))CloudkmsProjectsGetKajPolicyConfigRequesti5 zA CloudkmsProjectsGetKajPolicyConfigRequest object.
Fields:
name: Required. The name of the KeyAccessJustificationsPolicyConfig to
get.
r Tr r
Nr r
r r r r 5 r r r c \ rS rSrSr\R " S\R R S9r \R " SSS9r Sr g )
5CloudkmsProjectsLocationsEkmConfigGetIamPolicyRequesti@ aA A CloudkmsProjectsLocationsEkmConfigGetIamPolicyRequest object.
Fields:
options_requestedPolicyVersion: Optional. The maximum policy version that
will be used to format the policy. Valid values are 0, 1, and 3.
Requests specifying an invalid value will be rejected. Requests for
policies with any conditional role bindings must specify version 3.
Policies with no conditional role bindings may specify any valid value
or leave the field unset. The policy in the response might use the
policy version that you specified, or it might use a lower policy
version. For example, if you specify version 3, but the policy has no
conditional role bindings, the response uses version 1. To learn which
resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
r variantr Tr r
N
r r r r r r r VariantINT32 options_requestedPolicyVersionrF resourcer r
r r r r @ : * $-#9#9!YEVEVE\E\#]
"
"1t
4(r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
5CloudkmsProjectsLocationsEkmConfigSetIamPolicyRequestiZ aq A CloudkmsProjectsLocationsEkmConfigSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r Tr SetIamPolicyRequestr r
N r r r r r r rF r r: setIamPolicyRequestr r
r r r r Z /
"
"1t
4(!../DaHr r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
;CloudkmsProjectsLocationsEkmConfigTestIamPermissionsRequestij a A CloudkmsProjectsLocationsEkmConfigTestIamPermissionsRequest object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r Tr TestIamPermissionsRequestr r
N r r r r r r rF r r: testIamPermissionsRequestr r
r r r r j 0
"
"1t
4( ' 4 45PRS Tr r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) 4CloudkmsProjectsLocationsEkmConnectionsCreateRequestiz a A CloudkmsProjectsLocationsEkmConnectionsCreateRequest object.
Fields:
ekmConnection: A EkmConnection resource to be passed as the request body.
ekmConnectionId: Required. It must be unique within a location and match
the regular expression `[a-zA-Z0-9_-]{1,63}`.
parent: Required. The resource name of the location associated with the
EkmConnection, in the format `projects/*/locations/*`.
EkmConnectionr r r# Tr r
N) r r r r r r r:
ekmConnectionrF ekmConnectionIdparentr r
r r r r z s= (( !<- ))!,/ T 2&r r c \ rS rSrSr\R " S\R R S9r \R " SSS9r Sr g )
:CloudkmsProjectsLocationsEkmConnectionsGetIamPolicyRequesti aF A CloudkmsProjectsLocationsEkmConnectionsGetIamPolicyRequest object.
Fields:
options_requestedPolicyVersion: Optional. The maximum policy version that
will be used to format the policy. Valid values are 0, 1, and 3.
Requests specifying an invalid value will be rejected. Requests for
policies with any conditional role bindings must specify version 3.
Policies with no conditional role bindings may specify any valid value
or leave the field unset. The policy in the response might use the
policy version that you specified, or it might use a lower policy
version. For example, if you specify version 3, but the policy has no
conditional role bindings, the response uses version 1. To learn which
resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
r r r Tr r
Nr r
r r r r r r r c : \ rS rSrSr\R " SSS9rSrg)1CloudkmsProjectsLocationsEkmConnectionsGetRequesti z}A CloudkmsProjectsLocationsEkmConnectionsGetRequest object.
Fields:
name: Required. The name of the EkmConnection to get.
r Tr r
Nr r
r r r r
q4 0$r r c \ rS rSrSr\R " S5 r\R " S5 r\R " S\R R S9r \R " S5 r
\R " SS S
9rS rg )
2CloudkmsProjectsLocationsEkmConnectionsListRequesti a\ A CloudkmsProjectsLocationsEkmConnectionsListRequest object.
Fields:
filter: Optional. Only include resources that match the filter in the
response. For more information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
orderBy: Optional. Specify how the results should be sorted. If not
specified, the results will be sorted in the default order. For more
information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
pageSize: Optional. Optional limit on the number of EkmConnections to
include in the response. Further EkmConnections can subsequently be
obtained by including the ListEkmConnectionsResponse.next_page_token in
a subsequent request. If unspecified, the server will pick an
appropriate default.
pageToken: Optional. Optional pagination token, returned earlier via
ListEkmConnectionsResponse.next_page_token.
parent: Required. The resource name of the location associated with the
EkmConnections to list, in the format `projects/*/locations/*`.
r r r# r r$ rD Tr r
Nr r r r r r rF filterorderByr r r pageSize pageTokenr r r
r r r r si * #& ! !! $'
#
#Ay/@/@/F/F
G(##A&) T 2&r r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 3CloudkmsProjectsLocationsEkmConnectionsPatchRequesti aS A CloudkmsProjectsLocationsEkmConnectionsPatchRequest object.
Fields:
ekmConnection: A EkmConnection resource to be passed as the request body.
name: Output only. The resource name for the EkmConnection in the format
`projects/*/locations/*/ekmConnections/*`.
updateMask: Required. List of fields to be updated in this request.
r r r Tr r# r
N) r r r r r r r: r rF rG r r r
r r r r s= (( !<- q4 0$$$Q'*r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
:CloudkmsProjectsLocationsEkmConnectionsSetIamPolicyRequesti av A CloudkmsProjectsLocationsEkmConnectionsSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r Tr r r r
Nr r
r r r r r r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
@CloudkmsProjectsLocationsEkmConnectionsTestIamPermissionsRequesti a A CloudkmsProjectsLocationsEkmConnectionsTestIamPermissionsRequest
object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r Tr r r r
Nr r
r r r r 0
"
"1t
4( ' 4 45PRS Tr r c : \ rS rSrSr\R " SSS9rSrg)@CloudkmsProjectsLocationsEkmConnectionsVerifyConnectivityRequesti zA CloudkmsProjectsLocationsEkmConnectionsVerifyConnectivityRequest
object.
Fields:
name: Required. The name of the EkmConnection to verify.
r Tr r
Nr r
r r r r r r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
3CloudkmsProjectsLocationsGenerateRandomBytesRequesti a< A CloudkmsProjectsLocationsGenerateRandomBytesRequest object.
Fields:
generateRandomBytesRequest: A GenerateRandomBytesRequest resource to be
passed as the request body.
location: The project-specific location in which to generate random bytes.
For example, "projects/my-project/locations/us-central1".
GenerateRandomBytesRequestr r Tr r
N) r r r r r r r: generateRandomBytesRequestrF locationr r
r r r r s0 ) 5 56RTU V
"
"1t
4(r r c : \ rS rSrSr\R " SSS9rSrg),CloudkmsProjectsLocationsGetEkmConfigRequesti ztA CloudkmsProjectsLocationsGetEkmConfigRequest object.
Fields:
name: Required. The name of the EkmConfig to get.
r Tr r
Nr r
r r r r r r r c : \ rS rSrSr\R " SSS9rSrg)#CloudkmsProjectsLocationsGetRequesti z_A CloudkmsProjectsLocationsGetRequest object.
Fields:
name: Resource name for the location.
r Tr r
Nr r
r r r r r r r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) 0CloudkmsProjectsLocationsKeyHandlesCreateRequesti( a A CloudkmsProjectsLocationsKeyHandlesCreateRequest object.
Fields:
keyHandle: A KeyHandle resource to be passed as the request body.
keyHandleId: Optional. Id of the KeyHandle. Must be unique to the resource
project and location. If not provided by the caller, a new UUID is used.
parent: Required. Name of the resource project and location to create the
KeyHandle in, e.g. `projects/{PROJECT_ID}/locations/{LOCATION}`.
KeyHandler r r# Tr r
N) r r r r r r r: keyHandlerF keyHandleIdr r r
r r r r ( s= $$[!4)%%a(+ T 2&r r c : \ rS rSrSr\R " SSS9rSrg)-CloudkmsProjectsLocationsKeyHandlesGetRequesti8 zA CloudkmsProjectsLocationsKeyHandlesGetRequest object.
Fields:
name: Required. Name of the KeyHandle resource, e.g.
`projects/{PROJECT_ID}/locations/{LOCATION}/keyHandles/{KEY_HANDLE_ID}`.
r Tr r
Nr r
r r r r 8 r r r c \ rS rSrSr\R " S5 r\R " S\R R S9r \R " S5 r \R " SSS 9r
S
rg ) .CloudkmsProjectsLocationsKeyHandlesListRequestiC a A CloudkmsProjectsLocationsKeyHandlesListRequest object.
Fields:
filter: Optional. Filter to apply when listing KeyHandles, e.g.
`resource_type_selector="{SERVICE}.googleapis.com/{TYPE}"`.
pageSize: Optional. Optional limit on the number of KeyHandles to include
in the response. The service may return fewer than this value. Further
KeyHandles can subsequently be obtained by including the
ListKeyHandlesResponse.next_page_token in a subsequent request. If
unspecified, at most 100 KeyHandles will be returned.
pageToken: Optional. Optional pagination token, returned earlier via
ListKeyHandlesResponse.next_page_token.
parent: Required. Name of the resource project and location from which to
list KeyHandles, e.g. `projects/{PROJECT_ID}/locations/{LOCATION}`.
r r r r# r$ Tr r
N)r r r r r r rF r r r r r r r r r
r r r r C sY #&
#
#Ay/@/@/F/F
G(##A&) T 2&r r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) .CloudkmsProjectsLocationsKeyRingsCreateRequestiZ ax A CloudkmsProjectsLocationsKeyRingsCreateRequest object.
Fields:
keyRing: A KeyRing resource to be passed as the request body.
keyRingId: Required. It must be unique within a location and match the
regular expression `[a-zA-Z0-9_-]{1,63}`
parent: Required. The resource name of the location associated with the
KeyRings, in the format `projects/*/locations/*`.
KeyRingr r r# Tr r
N) r r r r r r r: keyRingrF keyRingIdr r r
r r r r Z s=
" "9a 0'##A&) T 2&r r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
\R " S 5 r S
r
g ) 8CloudkmsProjectsLocationsKeyRingsCryptoKeysCreateRequestij a; A CloudkmsProjectsLocationsKeyRingsCryptoKeysCreateRequest object.
Fields:
cryptoKey: A CryptoKey resource to be passed as the request body.
cryptoKeyId: Required. It must be unique within a KeyRing and match the
regular expression `[a-zA-Z0-9_-]{1,63}`
parent: Required. The name of the KeyRing associated with the CryptoKeys.
skipInitialVersionCreation: If set to true, the request will create a
CryptoKey without any CryptoKeyVersions. You must manually call
CreateCryptoKeyVersion or ImportCryptoKeyVersion before you can use this
CryptoKey.
CryptoKeyr r r# Tr r$ r
N)r r r r r r r: cryptoKeyrF cryptoKeyIdr r2 skipInitialVersionCreationr r
r r r r j sN $$[!4)%%a(+ T 2& ( 5 5a 8 r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
TCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptRequesti~ a& A CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetric
DecryptRequest object.
Fields:
asymmetricDecryptRequest: A AsymmetricDecryptRequest resource to be passed
as the request body.
name: Required. The resource name of the CryptoKeyVersion to use for
decryption.
r r r Tr r
N) r r r r r r r: asymmetricDecryptRequestrF rG r r
r r r r ~ s0 ' 3 34NPQ R q4 0$r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
QCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSignRequesti a A CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetric
SignRequest object.
Fields:
asymmetricSignRequest: A AsymmetricSignRequest resource to be passed as
the request body.
name: Required. The resource name of the CryptoKeyVersion to use for
signing.
r5 r r Tr r
N) r r r r r r r: asymmetricSignRequestrF rG r r
r r r r s/ $001H!L q4 0$r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
ICloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreateRequesti a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreateRequest
object.
Fields:
cryptoKeyVersion: A CryptoKeyVersion resource to be passed as the request
body.
parent: Required. The name of the CryptoKey associated with the
CryptoKeyVersions.
CryptoKeyVersionr r Tr r
N) r r r r r r r: cryptoKeyVersionrF r r r
r r r r s/ ++,>B T 2&r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
NCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDecapsulateRequesti a A CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDecapsulat
eRequest object.
Fields:
decapsulateRequest: A DecapsulateRequest resource to be passed as the
request body.
name: Required. The resource name of the CryptoKeyVersion to use for
decapsulation.
DecapsulateRequestr r Tr r
N) r r r r r r r: decapsulateRequestrF rG r r
r r r r s/ !--.BAF q4 0$r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
JCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroyRequesti a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroyRequest
object.
Fields:
destroyCryptoKeyVersionRequest: A DestroyCryptoKeyVersionRequest resource
to be passed as the request body.
name: Required. The resource name of the CryptoKeyVersion to destroy.
DestroyCryptoKeyVersionRequestr r Tr r
N) r r r r r r r: destroyCryptoKeyVersionRequestrF rG r r
r r r r s0 $-#9#9:Z\]#^ q4 0$r r c \ rS rSrSr " S S\R 5 r\R " SSS9r \R " SS5 r S r g
) OCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKeyRequesti a{ A CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicK
eyRequest object.
Enums:
PublicKeyFormatValueValuesEnum: Optional. The PublicKey format specified
by the user. This field is required for PQC algorithms. If specified,
the public key will be exported through the public_key field in the
requested format. Otherwise, the pem field will be populated for non-PQC
algorithms, and an error will be returned for PQC algorithms.
Fields:
name: Required. The name of the CryptoKeyVersion public key to get.
publicKeyFormat: Optional. The PublicKey format specified by the user.
This field is required for PQC algorithms. If specified, the public key
will be exported through the public_key field in the requested format.
Otherwise, the pem field will be populated for non-PQC algorithms, and
an error will be returned for PQC algorithms.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
nCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKeyRequest.PublicKeyFormatValueValuesEnumi a Optional. The PublicKey format specified by the user. This field is
required for PQC algorithms. If specified, the public key will be exported
through the public_key field in the requested format. Otherwise, the pem
field will be populated for non-PQC algorithms, and an error will be
returned for PQC algorithms.
Values:
PUBLIC_KEY_FORMAT_UNSPECIFIED: If the public_key_format field is not
specified: - For PQC algorithms, an error will be returned. - For non-
PQC algorithms, the default format is PEM, and the field pem will be
populated. Otherwise, the public key will be exported through the
public_key field in the requested format.
PEM: The returned public key will be encoded in PEM format. See the
[RFC7468](https://tools.ietf.org/html/rfc7468) sections for [General
Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
[Textual Encoding of Subject Public Key Info]
(https://tools.ietf.org/html/rfc7468#section-13) for more information.
DER: The returned public key will be encoded in DER format (the
PrivateKeyInfo structure from RFC 5208).
NIST_PQC: This is supported only for PQC algorithms. The key material is
returned in the format defined by NIST PQC standards (FIPS 203, FIPS
204, and FIPS 205).
XWING_RAW_BYTES: The returned public key is in raw bytes format defined
in its standard https://datatracker.ietf.org/doc/draft-connolly-cfrg-
xwing-kem.
r r r r# r$ r
N r r r r r PUBLIC_KEY_FORMAT_UNSPECIFIEDPEMDERNIST_PQCXWING_RAW_BYTESr r
r r PublicKeyFormatValueValuesEnumr s# 4 %&!
C
CHOr r
r Tr r r
N)
r r r r r r r- r
rF rG r0 publicKeyFormatr r
r r r r s? & y~~ B
q4 0$ ''(H!L/r r c : \ rS rSrSr\R " SSS9rSrg)FCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetRequesti zA CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetRequest
object.
Fields:
name: Required. The name of the CryptoKeyVersion to get.
r Tr r
Nr r
r r r
r
r r r
c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
ICloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsImportRequesti aq A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsImportRequest
object.
Fields:
importCryptoKeyVersionRequest: A ImportCryptoKeyVersionRequest resource to
be passed as the request body.
parent: Required. The name of the CryptoKey to be imported into. The
create permission is only required on this key when creating a new
CryptoKeyVersion.
ImportCryptoKeyVersionRequestr r Tr r
N) r r r r r r r: importCryptoKeyVersionRequestrF r r r
r r r r s0
#,"8"89XZ["\ T 2&r r c @ \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S\R R S9r\R " S 5 r\R " S
S S 9r\R" " SS
5 rSrg)GCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListRequesti a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListRequest
object.
Enums:
ViewValueValuesEnum: The fields to include in the response.
Fields:
filter: Optional. Only include resources that match the filter in the
response. For more information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
orderBy: Optional. Specify how the results should be sorted. If not
specified, the results will be sorted in the default order. For more
information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
pageSize: Optional. Optional limit on the number of CryptoKeyVersions to
include in the response. Further CryptoKeyVersions can subsequently be
obtained by including the ListCryptoKeyVersionsResponse.next_page_token
in a subsequent request. If unspecified, the server will pick an
appropriate default.
pageToken: Optional. Optional pagination token, returned earlier via
ListCryptoKeyVersionsResponse.next_page_token.
parent: Required. The resource name of the CryptoKey to list, in the
format `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
view: The fields to include in the response.
c \ rS rSrSrSrSrSrg)[CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListRequest.ViewValueValuesEnumi; a The fields to include in the response.
Values:
CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED: Default view for each
CryptoKeyVersion. Does not include the attestation field.
FULL: Provides all fields in each CryptoKeyVersion, including the
attestation.
r r r
Nr r r r r #CRYPTO_KEY_VERSION_VIEW_UNSPECIFIEDFULLr r
r r ViewValueValuesEnumr ; +,' Dr r r r r# r r$ rD Tr rE r
N)r r r r r r r- r rF r r r r r r r r r0 viewr r
r r r r s 6
INN
#& ! !! $'
#
#Ay/@/@/F/F
G(##A&) T 2& 2A 6$r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
JCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsMacSignRequestiO a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsMacSignRequest
object.
Fields:
macSignRequest: A MacSignRequest resource to be passed as the request
body.
name: Required. The resource name of the CryptoKeyVersion to use for
signing.
MacSignRequestr r Tr r
N) r r r r r r r: macSignRequestrF rG r r
r r r r O s. ))*:A>. q4 0$r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
LCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsMacVerifyRequesti_ a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsMacVerifyRequest
object.
Fields:
macVerifyRequest: A MacVerifyRequest resource to be passed as the request
body.
name: Required. The resource name of the CryptoKeyVersion to use for
verification.
MacVerifyRequestr r Tr r
N) r r r r r r r: macVerifyRequestrF rG r r
r r r! r! _ s/ ++,>B q4 0$r r! c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) HCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatchRequestio a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatchRequest
object.
Fields:
cryptoKeyVersion: A CryptoKeyVersion resource to be passed as the request
body.
name: Output only. The resource name for this CryptoKeyVersion in the
format
`projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
updateMask: Required. List of fields to be updated in this request.
r r r Tr r# r
N) r r r r r r r: r rF rG r r r
r r r% r% o s? ++,>B q4 0$$$Q'*r r% c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
MCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRawDecryptRequesti a A CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRawDecrypt
Request object.
Fields:
name: Required. The resource name of the CryptoKeyVersion to use for
decryption.
rawDecryptRequest: A RawDecryptRequest resource to be passed as the
request body.
r Tr RawDecryptRequestr r
N) r r r r r r rF rG r: rawDecryptRequestr r
r r r' r' /
q4 0$ ,,-@!Dr r' c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
MCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRawEncryptRequesti a A CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRawEncrypt
Request object.
Fields:
name: Required. The resource name of the CryptoKeyVersion to use for
encryption.
rawEncryptRequest: A RawEncryptRequest resource to be passed as the
request body.
r Tr RawEncryptRequestr r
N) r r r r r r rF rG r: rawEncryptRequestr r
r r r, r, r* r r, c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
JCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestoreRequesti a A
CloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestoreRequest
object.
Fields:
name: Required. The resource name of the CryptoKeyVersion to restore.
restoreCryptoKeyVersionRequest: A RestoreCryptoKeyVersionRequest resource
to be passed as the request body.
r Tr RestoreCryptoKeyVersionRequestr r
N) r r r r r r rF rG r: restoreCryptoKeyVersionRequestr r
r r r0 r0 s0
q4 0$#,#9#9:Z\]#^ r r0 c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
9CloudkmsProjectsLocationsKeyRingsCryptoKeysDecryptRequesti a A CloudkmsProjectsLocationsKeyRingsCryptoKeysDecryptRequest object.
Fields:
decryptRequest: A DecryptRequest resource to be passed as the request
body.
name: Required. The resource name of the CryptoKey to use for decryption.
The server will choose the appropriate version.
DecryptRequestr r Tr r
N) r r r r r r r: decryptRequestrF rG r r
r r r4 r4 s. ))*:A>. q4 0$r r4 c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
9CloudkmsProjectsLocationsKeyRingsCryptoKeysEncryptRequesti aM A CloudkmsProjectsLocationsKeyRingsCryptoKeysEncryptRequest object.
Fields:
encryptRequest: A EncryptRequest resource to be passed as the request
body.
name: Required. The resource name of the CryptoKey or CryptoKeyVersion to
use for encryption. If a CryptoKey is specified, the server will use its
primary version.
EncryptRequestr r Tr r
N) r r r r r r r: encryptRequestrF rG r r
r r r8 r8 s. ))*:A>. q4 0$r r8 c \ rS rSrSr\R " S\R R S9r \R " SSS9r Sr g )
>CloudkmsProjectsLocationsKeyRingsCryptoKeysGetIamPolicyRequesti aJ A CloudkmsProjectsLocationsKeyRingsCryptoKeysGetIamPolicyRequest object.
Fields:
options_requestedPolicyVersion: Optional. The maximum policy version that
will be used to format the policy. Valid values are 0, 1, and 3.
Requests specifying an invalid value will be rejected. Requests for
policies with any conditional role bindings must specify version 3.
Policies with no conditional role bindings may specify any valid value
or leave the field unset. The policy in the response might use the
policy version that you specified, or it might use a lower policy
version. For example, if you specify version 3, but the policy has no
conditional role bindings, the response uses version 1. To learn which
resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
r r r Tr r
Nr r
r r r< r< r r r< c : \ rS rSrSr\R " SSS9rSrg)5CloudkmsProjectsLocationsKeyRingsCryptoKeysGetRequesti z}A CloudkmsProjectsLocationsKeyRingsCryptoKeysGetRequest object.
Fields:
name: Required. The name of the CryptoKey to get.
r Tr r
Nr r
r r r> r> r r r> c @ \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S\R R S9r\R " S 5 r\R " S
S S 9r\R" " SS
5 rSrg)6CloudkmsProjectsLocationsKeyRingsCryptoKeysListRequesti a A CloudkmsProjectsLocationsKeyRingsCryptoKeysListRequest object.
Enums:
VersionViewValueValuesEnum: The fields of the primary version to include
in the response.
Fields:
filter: Optional. Only include resources that match the filter in the
response. For more information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
orderBy: Optional. Specify how the results should be sorted. If not
specified, the results will be sorted in the default order. For more
information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
pageSize: Optional. Optional limit on the number of CryptoKeys to include
in the response. Further CryptoKeys can subsequently be obtained by
including the ListCryptoKeysResponse.next_page_token in a subsequent
request. If unspecified, the server will pick an appropriate default.
pageToken: Optional. Optional pagination token, returned earlier via
ListCryptoKeysResponse.next_page_token.
parent: Required. The resource name of the KeyRing to list, in the format
`projects/*/locations/*/keyRings/*`.
versionView: The fields of the primary version to include in the response.
c \ rS rSrSrSrSrSrg)QCloudkmsProjectsLocationsKeyRingsCryptoKeysListRequest.VersionViewValueValuesEnumi
a The fields of the primary version to include in the response.
Values:
CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED: Default view for each
CryptoKeyVersion. Does not include the attestation field.
FULL: Provides all fields in each CryptoKeyVersion, including the
attestation.
r r r
Nr r
r r VersionViewValueValuesEnumrB
r r rC r r r# r r$ rD Tr rE r
N)r r r r r r r- rC rF r r r r r r r r r0 versionViewr r
r r r@ r@ s 2
9>>
#& ! !! $'
#
#Ay/@/@/F/F
G(##A&) T 2&##$@!D+r r@ c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 7CloudkmsProjectsLocationsKeyRingsCryptoKeysPatchRequesti aS A CloudkmsProjectsLocationsKeyRingsCryptoKeysPatchRequest object.
Fields:
cryptoKey: A CryptoKey resource to be passed as the request body.
name: Output only. The resource name for this CryptoKey in the format
`projects/*/locations/*/keyRings/*/cryptoKeys/*`.
updateMask: Required. List of fields to be updated in this request.
r r r Tr r# r
N) r r r r r r r: r rF rG r r r
r r rF rF = $$[!4) q4 0$$$Q'*r rF c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
>CloudkmsProjectsLocationsKeyRingsCryptoKeysSetIamPolicyRequesti- az A CloudkmsProjectsLocationsKeyRingsCryptoKeysSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r Tr r r r
Nr r
r r rI rI - r r rI c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
DCloudkmsProjectsLocationsKeyRingsCryptoKeysTestIamPermissionsRequesti= a A CloudkmsProjectsLocationsKeyRingsCryptoKeysTestIamPermissionsRequest
object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r Tr r r r
Nr r
r r rK rK = r r rK c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
FCloudkmsProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionRequestiN a A CloudkmsProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionRequest
object.
Fields:
name: Required. The resource name of the CryptoKey to update.
updateCryptoKeyPrimaryVersionRequest: A
UpdateCryptoKeyPrimaryVersionRequest resource to be passed as the
request body.
r Tr $UpdateCryptoKeyPrimaryVersionRequestr r
N) r r r r r r rF rG r: $updateCryptoKeyPrimaryVersionRequestr r
r r rM rM N s0
q4 0$)2)?)?@fhi)j&r rM c \ rS rSrSr\R " S\R R S9r \R " SSS9r Sr g )
4CloudkmsProjectsLocationsKeyRingsGetIamPolicyRequesti] a@ A CloudkmsProjectsLocationsKeyRingsGetIamPolicyRequest object.
Fields:
options_requestedPolicyVersion: Optional. The maximum policy version that
will be used to format the policy. Valid values are 0, 1, and 3.
Requests specifying an invalid value will be rejected. Requests for
policies with any conditional role bindings must specify version 3.
Policies with no conditional role bindings may specify any valid value
or leave the field unset. The policy in the response might use the
policy version that you specified, or it might use a lower policy
version. For example, if you specify version 3, but the policy has no
conditional role bindings, the response uses version 1. To learn which
resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
r r r Tr r
Nr r
r r rQ rQ ] r r rQ c : \ rS rSrSr\R " SSS9rSrg)+CloudkmsProjectsLocationsKeyRingsGetRequestiw zqA CloudkmsProjectsLocationsKeyRingsGetRequest object.
Fields:
name: Required. The name of the KeyRing to get.
r Tr r
Nr r
r r rS rS w r r rS c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) 8CloudkmsProjectsLocationsKeyRingsImportJobsCreateRequesti aS A CloudkmsProjectsLocationsKeyRingsImportJobsCreateRequest object.
Fields:
importJob: A ImportJob resource to be passed as the request body.
importJobId: Required. It must be unique within a KeyRing and match the
regular expression `[a-zA-Z0-9_-]{1,63}`
parent: Required. The name of the KeyRing associated with the ImportJobs.
ImportJobr r r# Tr r
N) r r r r r r r: importJobrF importJobIdr r r
r r rU rU s= $$[!4)%%a(+ T 2&r rU c \ rS rSrSr\R " S\R R S9r \R " SSS9r Sr g )
>CloudkmsProjectsLocationsKeyRingsImportJobsGetIamPolicyRequesti aJ A CloudkmsProjectsLocationsKeyRingsImportJobsGetIamPolicyRequest object.
Fields:
options_requestedPolicyVersion: Optional. The maximum policy version that
will be used to format the policy. Valid values are 0, 1, and 3.
Requests specifying an invalid value will be rejected. Requests for
policies with any conditional role bindings must specify version 3.
Policies with no conditional role bindings may specify any valid value
or leave the field unset. The policy in the response might use the
policy version that you specified, or it might use a lower policy
version. For example, if you specify version 3, but the policy has no
conditional role bindings, the response uses version 1. To learn which
resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
r r r Tr r
Nr r
r r rZ rZ r r rZ c : \ rS rSrSr\R " SSS9rSrg)5CloudkmsProjectsLocationsKeyRingsImportJobsGetRequesti z}A CloudkmsProjectsLocationsKeyRingsImportJobsGetRequest object.
Fields:
name: Required. The name of the ImportJob to get.
r Tr r
Nr r
r r r\ r\ r r r\ c \ rS rSrSr\R " S5 r\R " S5 r\R " S\R R S9r \R " S5 r
\R " SS S
9rS rg )
6CloudkmsProjectsLocationsKeyRingsImportJobsListRequesti a3 A CloudkmsProjectsLocationsKeyRingsImportJobsListRequest object.
Fields:
filter: Optional. Only include resources that match the filter in the
response. For more information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
orderBy: Optional. Specify how the results should be sorted. If not
specified, the results will be sorted in the default order. For more
information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
pageSize: Optional. Optional limit on the number of ImportJobs to include
in the response. Further ImportJobs can subsequently be obtained by
including the ListImportJobsResponse.next_page_token in a subsequent
request. If unspecified, the server will pick an appropriate default.
pageToken: Optional. Optional pagination token, returned earlier via
ListImportJobsResponse.next_page_token.
parent: Required. The resource name of the KeyRing to list, in the format
`projects/*/locations/*/keyRings/*`.
r r r# r r$ rD Tr r
Nr r
r r r^ r^ i ( #& ! !! $'
#
#Ay/@/@/F/F
G(##A&) T 2&r r^ c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
>CloudkmsProjectsLocationsKeyRingsImportJobsSetIamPolicyRequesti az A CloudkmsProjectsLocationsKeyRingsImportJobsSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r Tr r r r
Nr r
r r ra ra r r ra c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
DCloudkmsProjectsLocationsKeyRingsImportJobsTestIamPermissionsRequesti a A CloudkmsProjectsLocationsKeyRingsImportJobsTestIamPermissionsRequest
object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r Tr r r r
Nr r
r r rc rc r r rc c \ rS rSrSr\R " S5 r\R " S5 r\R " S\R R S9r \R " S5 r
\R " SS S
9rS rg )
,CloudkmsProjectsLocationsKeyRingsListRequesti a, A CloudkmsProjectsLocationsKeyRingsListRequest object.
Fields:
filter: Optional. Only include resources that match the filter in the
response. For more information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
orderBy: Optional. Specify how the results should be sorted. If not
specified, the results will be sorted in the default order. For more
information, see [Sorting and filtering list
results](https://cloud.google.com/kms/docs/sorting-and-filtering).
pageSize: Optional. Optional limit on the number of KeyRings to include in
the response. Further KeyRings can subsequently be obtained by including
the ListKeyRingsResponse.next_page_token in a subsequent request. If
unspecified, the server will pick an appropriate default.
pageToken: Optional. Optional pagination token, returned earlier via
ListKeyRingsResponse.next_page_token.
parent: Required. The resource name of the location associated with the
KeyRings, in the format `projects/*/locations/*`.
r r r# r r$ rD Tr r
Nr r
r r re re r_ r re c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
4CloudkmsProjectsLocationsKeyRingsSetIamPolicyRequesti
ap A CloudkmsProjectsLocationsKeyRingsSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r Tr r r r
Nr r
r r rg rg
r r rg c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
:CloudkmsProjectsLocationsKeyRingsTestIamPermissionsRequesti a A CloudkmsProjectsLocationsKeyRingsTestIamPermissionsRequest object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r Tr r r r
Nr r
r r ri ri r r ri c \ rS rSrSr\R " SSS9r\R " S5 r\R " SSS9r \R " S \R R S
9r
\R " S 5 rS rg
)$CloudkmsProjectsLocationsListRequesti- a A CloudkmsProjectsLocationsListRequest object.
Fields:
extraLocationTypes: Optional. Do not use this field. It is unsupported and
is ignored unless explicitly documented otherwise. This is primarily for
internal usage.
filter: A filter to narrow down results to a preferred subset. The
filtering language accepts strings like `"displayName=tokyo"`, and is
documented in more detail in [AIP-160](https://google.aip.dev/160).
name: The resource that owns the locations collection, if applicable.
pageSize: The maximum number of results to return. If not set, the service
selects a default.
pageToken: A page token received from the `next_page_token` field in the
response. Send that page token to receive the subsequent page.
r TrP r r# r r$ r rD r
N)r r r r r r rF extraLocationTypesr rG r r r r r r r
r r rk rk - sl !,,Q> #& q4 0$
#
#Ay/@/@/F/F
G(##A&)r rk c : \ rS rSrSr\R " SSS9rSrg)-CloudkmsProjectsLocationsOperationsGetRequestiE zmA CloudkmsProjectsLocationsOperationsGetRequest object.
Fields:
name: The name of the operation resource.
r Tr r
Nr r
r r rn rn E r r rn c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) /CloudkmsProjectsLocationsUpdateEkmConfigRequestiO a< A CloudkmsProjectsLocationsUpdateEkmConfigRequest object.
Fields:
ekmConfig: A EkmConfig resource to be passed as the request body.
name: Output only. The resource name for the EkmConfig in the format
`projects/*/locations/*/ekmConfig`.
updateMask: Required. List of fields to be updated in this request.
EkmConfigr r Tr r# r
N) r r r r r r r: ekmConfigrF rG r r r
r r rp rp O rG r rp c : \ rS rSrSr\R " SSS9rSrg)1CloudkmsProjectsShowEffectiveAutokeyConfigRequesti^ a' A CloudkmsProjectsShowEffectiveAutokeyConfigRequest object.
Fields:
parent: Required. Name of the resource project to the show effective Cloud
KMS Autokey configuration for. This may be helpful for interrogating the
effect of nested folder configurations on a given resource project.
r Tr r
N) r r r r r r rF r r r
r r rt rt ^ s T 2&r rt c : \ rS rSrSr\R " SSS9rSrg)KCloudkmsProjectsShowEffectiveKeyAccessJustificationsEnrollmentConfigRequestij zA
CloudkmsProjectsShowEffectiveKeyAccessJustificationsEnrollmentConfigRequest
object.
Fields:
project: Required. The number or id of the project to get the effective
KeyAccessJustificationsEnrollmentConfig for.
r Tr r
N r r r r r r rF projectr r
r r rv rv j
! !!d 3'r rv c : \ rS rSrSr\R " SSS9rSrg)GCloudkmsProjectsShowEffectiveKeyAccessJustificationsPolicyConfigRequestiw zA
CloudkmsProjectsShowEffectiveKeyAccessJustificationsPolicyConfigRequest
object.
Fields:
project: Required. The number or id of the project to get the effective
KeyAccessJustificationsPolicyConfig. In the format of "projects/{|}"
r Tr r
Nrw r
r r r{ r{ w ry r r{ c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) ,CloudkmsProjectsUpdateKajPolicyConfigRequesti a A CloudkmsProjectsUpdateKajPolicyConfigRequest object.
Fields:
keyAccessJustificationsPolicyConfig: A KeyAccessJustificationsPolicyConfig
resource to be passed as the request body.
name: Identifier. The resource name for this
KeyAccessJustificationsPolicyConfig in the format of
"{organizations|folders|projects}/*/kajPolicyConfig".
updateMask: Optional. The list of fields to update.
r r r Tr r# r
Nr r
r r r} r} r r r} c P \ rS rSrSr " S S\R 5 r\R " S5 " S S\R 5 5 r \R " S5 r
\R " S 5 r\R " S
5 r\R " S 5 r\R$ " S S
5 r\R$ " SS5 r\R " S5 r\R " S5 r\R$ " SS5 r\R0 " SS5 r\R " S5 r\R$ " SS5 rSr g)r i aI A CryptoKey represents a logical key that can be used for cryptographic
operations. A CryptoKey is made up of zero or more versions, which represent
the actual key material used in cryptographic operations.
Enums:
PurposeValueValuesEnum: Immutable. The immutable purpose of this
CryptoKey.
Messages:
LabelsValue: Labels with user-defined metadata. For more information, see
[Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
Fields:
createTime: Output only. The time at which this CryptoKey was created.
cryptoKeyBackend: Immutable. The resource name of the backend environment
where the key material for all CryptoKeyVersions associated with this
CryptoKey reside and where all related cryptographic operations are
performed. Only applicable if CryptoKeyVersions have a ProtectionLevel
of EXTERNAL_VPC, with the resource name in the format
`projects/*/locations/*/ekmConnections/*`. Note, this list is non-
exhaustive and may apply to additional ProtectionLevels in the future.
destroyScheduledDuration: Immutable. The period of time that versions of
this key spend in the DESTROY_SCHEDULED state before transitioning to
DESTROYED. If not specified at creation time, the default duration is 30
days.
importOnly: Immutable. Whether this key may contain imported versions
only.
keyAccessJustificationsPolicy: Optional. The policy used for Key Access
Justifications Policy Enforcement. If this field is present and this key
is enrolled in Key Access Justifications Policy Enforcement, the policy
will be evaluated in encrypt, decrypt, and sign operations, and the
operation will fail if rejected by the policy. The policy is defined by
specifying zero or more allowed justification codes.
https://cloud.google.com/assured-workloads/key-access-
justifications/docs/justification-codes By default, this field is
absent, and all justification codes are allowed.
labels: Labels with user-defined metadata. For more information, see
[Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
name: Output only. The resource name for this CryptoKey in the format
`projects/*/locations/*/keyRings/*/cryptoKeys/*`.
nextRotationTime: At next_rotation_time, the Key Management Service will
automatically: 1. Create a new version of this CryptoKey. 2. Mark the
new version as primary. Key rotations performed manually via
CreateCryptoKeyVersion and UpdateCryptoKeyPrimaryVersion do not affect
next_rotation_time. Keys with purpose ENCRYPT_DECRYPT support automatic
rotation. For other keys, this field must be omitted.
primary: Output only. A copy of the "primary" CryptoKeyVersion that will
be used by Encrypt when this CryptoKey is given in EncryptRequest.name.
The CryptoKey's primary version can be updated via
UpdateCryptoKeyPrimaryVersion. Keys with purpose ENCRYPT_DECRYPT may
have a primary. For other keys, this field will be omitted.
purpose: Immutable. The immutable purpose of this CryptoKey.
rotationPeriod: next_rotation_time will be advanced by this period when
the service automatically rotates a key. Must be at least 24 hours and
at most 876,000 hours. If rotation_period is set, next_rotation_time
must also be set. Keys with purpose ENCRYPT_DECRYPT support automatic
rotation. For other keys, this field must be omitted.
versionTemplate: A template describing settings for new CryptoKeyVersion
instances. The properties of new CryptoKeyVersion instances created by
either CreateCryptoKeyVersion or auto-rotation are controlled by this
template.
c 4 \ rS rSrSrSrSrSrSrSr Sr
S r S
r g ) CryptoKey.PurposeValueValuesEnumi a$ Immutable. The immutable purpose of this CryptoKey.
Values:
CRYPTO_KEY_PURPOSE_UNSPECIFIED: Not specified.
ENCRYPT_DECRYPT: CryptoKeys with this purpose may be used with Encrypt
and Decrypt.
ASYMMETRIC_SIGN: CryptoKeys with this purpose may be used with
AsymmetricSign and GetPublicKey.
ASYMMETRIC_DECRYPT: CryptoKeys with this purpose may be used with
AsymmetricDecrypt and GetPublicKey.
RAW_ENCRYPT_DECRYPT: CryptoKeys with this purpose may be used with
RawEncrypt and RawDecrypt. This purpose is meant to be used for
interoperable symmetric encryption and does not support automatic
CryptoKey rotation.
MAC: CryptoKeys with this purpose may be used with MacSign.
KEY_ENCAPSULATION: CryptoKeys with this purpose may be used with
GetPublicKey and Decapsulate.
r r r r# r$ rD rE r
N)
r r r r r CRYPTO_KEY_PURPOSE_UNSPECIFIEDENCRYPT_DECRYPTASYMMETRIC_SIGNASYMMETRIC_DECRYPTRAW_ENCRYPT_DECRYPTMACKEY_ENCAPSULATIONr r
r r PurposeValueValuesEnumr s0 $ &'"OO
Cr r additionalPropertiesc f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
CryptoKey.LabelsValuei a Labels with user-defined metadata. For more information, see [Labeling
Keys](https://cloud.google.com/kms/docs/labeling-keys).
Messages:
AdditionalProperty: An additional property for a LabelsValue object.
Fields:
additionalProperties: Additional properties of type LabelsValue
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)(CryptoKey.LabelsValue.AdditionalPropertyi An additional property for a LabelsValue object.
Fields:
key: Name of the additional property.
value: A string attribute.
r r r
N
r r r r r r rF keyvaluer r
r r AdditionalPropertyr )
! !! $c##A&er r r TrP r
N r r r r r r Messager r: r r r
r r LabelsValuer 2 'Y . . ' %112FTXYr r r r r# r$ KeyAccessJustificationsPolicyrD rE rt ru r rv
CryptoKeyVersionTemplate r
N) r r r r r r r- r r MapUnrecognizedFieldsr r rF
createTimecryptoKeyBackenddestroyScheduledDurationr2
importOnlyr: keyAccessJustificationsPolicylabelsrG nextRotationTimeprimaryr0 purposerotationPeriodversionTemplater r
r r r r s =~y~~ 6 !!"89ZI%% Z :Z0 $$Q'* **1- & 2 21 5%%a(*"+"8"89XZ["\ ! !- 3& q !$ **1- " "#5q 9' 8" =' ((,. **+ErJ/r r c \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r \R " SS 5 r \R " S
S 5 r
\R " S 5 r\R " S
5 r\R " S5 r\R " S5 r\R " SS5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " SS5 r\R6 " S5 r \R " SS5 r Sr g ) r i a A CryptoKeyVersion represents an individual cryptographic key, and the
associated key material. An ENABLED version can be used for cryptographic
operations. For security reasons, the raw cryptographic key material
represented by a CryptoKeyVersion can never be viewed or exported. It can
only be used to encrypt, decrypt, or sign data when an authorized user or
application invokes Cloud KMS.
Enums:
AlgorithmValueValuesEnum: Output only. The CryptoKeyVersionAlgorithm that
this CryptoKeyVersion supports.
ProtectionLevelValueValuesEnum: Output only. The ProtectionLevel
describing how crypto operations are performed with this
CryptoKeyVersion.
StateValueValuesEnum: The current state of the CryptoKeyVersion.
Fields:
algorithm: Output only. The CryptoKeyVersionAlgorithm that this
CryptoKeyVersion supports.
attestation: Output only. Statement that was generated and signed by the
HSM at key creation time. Use this statement to verify attributes of the
key as stored on the HSM, independently of Google. Only provided for key
versions with protection_level HSM.
createTime: Output only. The time at which this CryptoKeyVersion was
created.
destroyEventTime: Output only. The time this CryptoKeyVersion's key
material was destroyed. Only present if state is DESTROYED.
destroyTime: Output only. The time this CryptoKeyVersion's key material is
scheduled for destruction. Only present if state is DESTROY_SCHEDULED.
externalDestructionFailureReason: Output only. The root cause of the most
recent external destruction failure. Only present if state is
EXTERNAL_DESTRUCTION_FAILED.
externalProtectionLevelOptions: ExternalProtectionLevelOptions stores a
group of additional fields for configuring a CryptoKeyVersion that are
specific to the EXTERNAL protection level and EXTERNAL_VPC protection
levels.
generateTime: Output only. The time this CryptoKeyVersion's key material
was generated.
generationFailureReason: Output only. The root cause of the most recent
generation failure. Only present if state is GENERATION_FAILED.
importFailureReason: Output only. The root cause of the most recent import
failure. Only present if state is IMPORT_FAILED.
importJob: Output only. The name of the ImportJob used in the most recent
import of this CryptoKeyVersion. Only present if the underlying key
material was imported.
importTime: Output only. The time at which this CryptoKeyVersion's key
material was most recently imported.
name: Output only. The resource name for this CryptoKeyVersion in the
format
`projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
protectionLevel: Output only. The ProtectionLevel describing how crypto
operations are performed with this CryptoKeyVersion.
reimportEligible: Output only. Whether or not this key version is eligible
for reimport, by being specified as a target in
ImportCryptoKeyVersionRequest.crypto_key_version.
state: The current state of the CryptoKeyVersion.
c \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrSrSrSrSrSrSrSrSr Sr S r S r S r S r!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0S/r1g0)1)CryptoKeyVersion.AlgorithmValueValuesEnumiQ a Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion
supports.
Values:
CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED: Not specified.
GOOGLE_SYMMETRIC_ENCRYPTION: Creates symmetric encryption keys.
AES_128_GCM: AES-GCM (Galois Counter Mode) using 128-bit keys.
AES_256_GCM: AES-GCM (Galois Counter Mode) using 256-bit keys.
AES_128_CBC: AES-CBC (Cipher Block Chaining Mode) using 128-bit keys.
AES_256_CBC: AES-CBC (Cipher Block Chaining Mode) using 256-bit keys.
AES_128_CTR: AES-CTR (Counter Mode) using 128-bit keys.
AES_256_CTR: AES-CTR (Counter Mode) using 256-bit keys.
RSA_SIGN_PSS_2048_SHA256: RSASSA-PSS 2048 bit key with a SHA256 digest.
RSA_SIGN_PSS_3072_SHA256: RSASSA-PSS 3072 bit key with a SHA256 digest.
RSA_SIGN_PSS_4096_SHA256: RSASSA-PSS 4096 bit key with a SHA256 digest.
RSA_SIGN_PSS_4096_SHA512: RSASSA-PSS 4096 bit key with a SHA512 digest.
RSA_SIGN_PKCS1_2048_SHA256: RSASSA-PKCS1-v1_5 with a 2048 bit key and a
SHA256 digest.
RSA_SIGN_PKCS1_3072_SHA256: RSASSA-PKCS1-v1_5 with a 3072 bit key and a
SHA256 digest.
RSA_SIGN_PKCS1_4096_SHA256: RSASSA-PKCS1-v1_5 with a 4096 bit key and a
SHA256 digest.
RSA_SIGN_PKCS1_4096_SHA512: RSASSA-PKCS1-v1_5 with a 4096 bit key and a
SHA512 digest.
RSA_SIGN_RAW_PKCS1_2048: RSASSA-PKCS1-v1_5 signing without encoding,
with a 2048 bit key.
RSA_SIGN_RAW_PKCS1_3072: RSASSA-PKCS1-v1_5 signing without encoding,
with a 3072 bit key.
RSA_SIGN_RAW_PKCS1_4096: RSASSA-PKCS1-v1_5 signing without encoding,
with a 4096 bit key.
RSA_DECRYPT_OAEP_2048_SHA256: RSAES-OAEP 2048 bit key with a SHA256
digest.
RSA_DECRYPT_OAEP_3072_SHA256: RSAES-OAEP 3072 bit key with a SHA256
digest.
RSA_DECRYPT_OAEP_4096_SHA256: RSAES-OAEP 4096 bit key with a SHA256
digest.
RSA_DECRYPT_OAEP_4096_SHA512: RSAES-OAEP 4096 bit key with a SHA512
digest.
RSA_DECRYPT_OAEP_2048_SHA1: RSAES-OAEP 2048 bit key with a SHA1 digest.
RSA_DECRYPT_OAEP_3072_SHA1: RSAES-OAEP 3072 bit key with a SHA1 digest.
RSA_DECRYPT_OAEP_4096_SHA1: RSAES-OAEP 4096 bit key with a SHA1 digest.
EC_SIGN_P256_SHA256: ECDSA on the NIST P-256 curve with a SHA256 digest.
Other hash functions can also be used:
https://cloud.google.com/kms/docs/create-validate-
signatures#ecdsa_support_for_other_hash_algorithms
EC_SIGN_P384_SHA384: ECDSA on the NIST P-384 curve with a SHA384 digest.
Other hash functions can also be used:
https://cloud.google.com/kms/docs/create-validate-
signatures#ecdsa_support_for_other_hash_algorithms
EC_SIGN_SECP256K1_SHA256: ECDSA on the non-NIST secp256k1 curve. This
curve is only supported for HSM protection level. Other hash functions
can also be used: https://cloud.google.com/kms/docs/create-validate-
signatures#ecdsa_support_for_other_hash_algorithms
EC_SIGN_ED25519: EdDSA on the Curve25519 in pure mode (taking data as
input).
HMAC_SHA256: HMAC-SHA256 signing with a 256 bit key.
HMAC_SHA1: HMAC-SHA1 signing with a 160 bit key.
HMAC_SHA384: HMAC-SHA384 signing with a 384 bit key.
HMAC_SHA512: HMAC-SHA512 signing with a 512 bit key.
HMAC_SHA224: HMAC-SHA224 signing with a 224 bit key.
EXTERNAL_SYMMETRIC_ENCRYPTION: Algorithm representing symmetric
encryption by an external key manager.
ML_KEM_768: ML-KEM-768 (FIPS 203)
ML_KEM_1024: ML-KEM-1024 (FIPS 203)
KEM_XWING: X-Wing hybrid KEM combining ML-KEM-768 with X25519 following
datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.
PQ_SIGN_ML_DSA_44: The post-quantum Module-Lattice-Based Digital
Signature Algorithm, at security level 1. Randomized version.
PQ_SIGN_ML_DSA_65: The post-quantum Module-Lattice-Based Digital
Signature Algorithm, at security level 3. Randomized version.
PQ_SIGN_ML_DSA_87: The post-quantum Module-Lattice-Based Digital
Signature Algorithm, at security level 5. Randomized version.
PQ_SIGN_SLH_DSA_SHA2_128S: The post-quantum stateless hash-based digital
signature algorithm, at security level 1. Randomized version.
PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256: The post-quantum stateless hash-
based digital signature algorithm, at security level 1. Randomized
pre-hash version supporting SHA256 digests.
r r r r# r$ rD rE rt ru rv r r r
r
! " # $ % & ' ( ) * r r
N2r r r r r (CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIEDGOOGLE_SYMMETRIC_ENCRYPTION AES_128_GCM AES_256_GCM AES_128_CBC AES_256_CBC AES_128_CTR AES_256_CTRRSA_SIGN_PSS_2048_SHA256RSA_SIGN_PSS_3072_SHA256RSA_SIGN_PSS_4096_SHA256RSA_SIGN_PSS_4096_SHA512RSA_SIGN_PKCS1_2048_SHA256RSA_SIGN_PKCS1_3072_SHA256RSA_SIGN_PKCS1_4096_SHA256RSA_SIGN_PKCS1_4096_SHA512RSA_SIGN_RAW_PKCS1_2048RSA_SIGN_RAW_PKCS1_3072RSA_SIGN_RAW_PKCS1_4096 RSA_DECRYPT_OAEP_2048_SHA256 RSA_DECRYPT_OAEP_3072_SHA256 RSA_DECRYPT_OAEP_4096_SHA256 RSA_DECRYPT_OAEP_4096_SHA512RSA_DECRYPT_OAEP_2048_SHA1RSA_DECRYPT_OAEP_3072_SHA1RSA_DECRYPT_OAEP_4096_SHA1EC_SIGN_P256_SHA256EC_SIGN_P384_SHA384EC_SIGN_SECP256K1_SHA256EC_SIGN_ED25519 HMAC_SHA256 HMAC_SHA1 HMAC_SHA384 HMAC_SHA512 HMAC_SHA224 EXTERNAL_SYMMETRIC_ENCRYPTION
ML_KEM_768 ML_KEM_1024 KEM_XWINGPQ_SIGN_ML_DSA_44PQ_SIGN_ML_DSA_65PQ_SIGN_ML_DSA_87PQ_SIGN_SLH_DSA_SHA2_128S%PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256r r
r r AlgorithmValueValuesEnumr Q M\ 01,"# KKKKKK ! ! !# !# !# !# #% #% #% #% !# !# !# ! OKIKKK$&!JKI " ,.)r r c , \ rS rSrSrSrSrSrSrSr Sr
g )
/CryptoKeyVersion.ProtectionLevelValueValuesEnumi a Output only. The ProtectionLevel describing how crypto operations are
performed with this CryptoKeyVersion.
Values:
PROTECTION_LEVEL_UNSPECIFIED: Not specified.
SOFTWARE: Crypto operations are performed in software.
HSM: Crypto operations are performed in a Hardware Security Module.
EXTERNAL: Crypto operations are performed by an external key manager.
EXTERNAL_VPC: Crypto operations are performed in an EKM-over-VPC
backend.
r r r r# r$ r
Nr% r
r r r+ r #
$% H
CHLr r+ c D \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrg)%CryptoKeyVersion.StateValueValuesEnumi a The current state of the CryptoKeyVersion.
Values:
CRYPTO_KEY_VERSION_STATE_UNSPECIFIED: Not specified.
PENDING_GENERATION: This version is still being generated. It may not be
used, enabled, disabled, or destroyed yet. Cloud KMS will
automatically mark this version ENABLED as soon as the version is
ready.
ENABLED: This version may be used for cryptographic operations.
DISABLED: This version may not be used, but the key material is still
available, and the version can be placed back into the ENABLED state.
DESTROYED: The key material of this version is destroyed and no longer
stored. This version may only become ENABLED again if this version is
reimport_eligible and the original key material is reimported with a
call to KeyManagementService.ImportCryptoKeyVersion.
DESTROY_SCHEDULED: This version is scheduled for destruction, and will
be destroyed soon. Call RestoreCryptoKeyVersion to put it back into
the DISABLED state.
PENDING_IMPORT: This version is still being imported. It may not be
used, enabled, disabled, or destroyed yet. Cloud KMS will
automatically mark this version ENABLED as soon as the version is
ready.
IMPORT_FAILED: This version was not imported successfully. It may not be
used, enabled, disabled, or destroyed. The submitted key material has
been discarded. Additional details can be found in
CryptoKeyVersion.import_failure_reason.
GENERATION_FAILED: This version was not generated successfully. It may
not be used, enabled, disabled, or destroyed. Additional details can
be found in CryptoKeyVersion.generation_failure_reason.
PENDING_EXTERNAL_DESTRUCTION: This version was destroyed, and it may not
be used or enabled again. Cloud KMS is waiting for the corresponding
key material residing in an external key manager to be destroyed.
EXTERNAL_DESTRUCTION_FAILED: This version was destroyed, and it may not
be used or enabled again. However, Cloud KMS could not confirm that
the corresponding key material residing in an external key manager was
destroyed. Additional details can be found in
CryptoKeyVersion.external_destruction_failure_reason.
r r r r# r$ rD rE rt ru rv r r
N)r r r r r $CRYPTO_KEY_VERSION_STATE_UNSPECIFIEDPENDING_GENERATIONENABLEDDISABLED DESTROYEDDESTROY_SCHEDULEDPENDING_IMPORT
IMPORT_FAILEDGENERATION_FAILED PENDING_EXTERNAL_DESTRUCTIONEXTERNAL_DESTRUCTION_FAILEDr r
r r rh r sG %L ,-(GHINM#$ "$ r rh r KeyOperationAttestationr r# r$ rD rE ExternalProtectionLevelOptionsrt ru rv r r r r r r r r
N) r r r r r r r- r r+ rh r0 algorithmr: attestationrF r destroyEventTime destroyTime externalDestructionFailureReason externalProtectionLevelOptions generateTimegenerationFailureReasonimportFailureReasonrW
importTimerG r1 r2 reimportEligiblerk r r
r r r r sT 7rz/ z/xy~~ $1%Y^^ 1%f !!"(>?^`a(b% q !$r r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)r i~ a Resource-oriented representation of a request to Cloud KMS Autokey and
the resulting provisioning of a CryptoKey.
Fields:
kmsKey: Output only. Name of a CryptoKey that has been provisioned for
Customer Managed Encryption Key (CMEK) use in the KeyHandle project and
location for the requested resource type. The CryptoKey project will
reflect the value configured in the AutokeyConfig on the resource
project's ancestor folder at the time of the KeyHandle creation. If more
than one ancestor folder has a configured AutokeyConfig, the nearest of
these configurations is used.
name: Identifier. Name of the KeyHandle resource, e.g.
`projects/{PROJECT_ID}/locations/{LOCATION}/keyHandles/{KEY_HANDLE_ID}`.
resourceTypeSelector: Required. Indicates the resource type that the
resulting CryptoKey is meant to protect, e.g.
`{SERVICE}.googleapis.com/{TYPE}`. See documentation for supported
resource types.
r r r# r
N) r r r r r r rF kmsKeyrG resourceTypeSelectorr r
r r r r ~ s: & #& q !$"..q1r r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " SS5 r
S rg
) r i a Contains an HSM-generated attestation about a key operation. For more
information, see [Verifying attestations]
(https://cloud.google.com/kms/docs/attest-key).
Enums:
FormatValueValuesEnum: Output only. The format of the attestation data.
Fields:
certChains: Output only. The certificate chains needed to validate the
attestation
content: Output only. The attestation data provided by the HSM when the
key operation was performed.
format: Output only. The format of the attestation data.
c $ \ rS rSrSrSrSrSrSrg)-KeyOperationAttestation.FormatValueValuesEnumi a Output only. The format of the attestation data.
Values:
ATTESTATION_FORMAT_UNSPECIFIED: Not specified.
CAVIUM_V1_COMPRESSED: Cavium HSM attestation compressed with gzip. Note
that this format is defined by Cavium and subject to change at any
time. See https://www.marvell.com/products/security-solutions/nitrox-
hs-adapters/software-key-attestation.html.
CAVIUM_V2_COMPRESSED: Cavium HSM attestation V2 compressed with gzip.
This is a new format introduced in Cavium's version 3.2-08.
r r r r
N) r r r r r ATTESTATION_FORMAT_UNSPECIFIEDCAVIUM_V1_COMPRESSEDCAVIUM_V2_COMPRESSEDr r
r r FormatValueValuesEnumr s
&'" r r r r r r# r
N)r r r r r r r- r r:
certChainsr contentr0 formatr r
r r r r sO
inn %%&91=* #' 6 :&r r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i zA KeyRing is a toplevel logical grouping of CryptoKeys.
Fields:
createTime: Output only. The time at which this KeyRing was created.
name: Output only. The resource name for the KeyRing in the format
`projects/*/locations/*/keyRings/*`.
r r r
N)
r r r r r r rF r rG r r
r r r r s) $$Q'* q !$r r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) ListCryptoKeyVersionsResponsei a Response message for KeyManagementService.ListCryptoKeyVersions.
Fields:
cryptoKeyVersions: The list of CryptoKeyVersions.
nextPageToken: A token to retrieve next page of results. Pass this value
in ListCryptoKeyVersionsRequest.page_token to retrieve the next page of
results.
totalSize: The total number of CryptoKeyVersions that matched the query.
This field is not populated if ListCryptoKeyVersionsRequest.filter is
applied.
r r TrP r r# r r
N)r r r r r r r: cryptoKeyVersionsrF
nextPageTokenr r r totalSizer r
r r r r sM
,,-?TR''*-$$Q 0A0A0G0GH)r r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) ListCryptoKeysResponsei a Response message for KeyManagementService.ListCryptoKeys.
Fields:
cryptoKeys: The list of CryptoKeys.
nextPageToken: A token to retrieve next page of results. Pass this value
in ListCryptoKeysRequest.page_token to retrieve the next page of
results.
totalSize: The total number of CryptoKeys that matched the query. This
field is not populated if ListCryptoKeysRequest.filter is applied.
r r TrP r r# r r
N)r r r r r r r:
cryptoKeysrF r r r r r r r
r r r r K %%k1tD*''*-$$Q 0A0A0G0GH)r r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) ListEkmConnectionsResponsei a Response message for EkmService.ListEkmConnections.
Fields:
ekmConnections: The list of EkmConnections.
nextPageToken: A token to retrieve next page of results. Pass this value
in ListEkmConnectionsRequest.page_token to retrieve the next page of
results.
totalSize: The total number of EkmConnections that matched the query. This
field is not populated if ListEkmConnectionsRequest.filter is applied.
r r TrP r r# r r
N)r r r r r r r: ekmConnectionsrF r r r r r r r
r r r r sK ))/1tL.''*-$$Q 0A0A0G0GH)r r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) ListImportJobsResponsei a Response message for KeyManagementService.ListImportJobs.
Fields:
importJobs: The list of ImportJobs.
nextPageToken: A token to retrieve next page of results. Pass this value
in ListImportJobsRequest.page_token to retrieve the next page of
results.
totalSize: The total number of ImportJobs that matched the query. This
field is not populated if ListImportJobsRequest.filter is applied.
rV r TrP r r# r r
N)r r r r r r r:
importJobsrF r r r r r r r
r r r r r r r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListKeyHandlesResponsei
zResponse message for Autokey.ListKeyHandles.
Fields:
keyHandles: Resulting KeyHandles.
nextPageToken: A token to retrieve next page of results. Pass this value
in ListKeyHandlesRequest.page_token to retrieve the next page of
results.
r r TrP r r
N) r r r r r r r:
keyHandlesrF r r r
r r r r
s- %%k1tD*''*-r r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) ListKeyRingsResponsei
a Response message for KeyManagementService.ListKeyRings.
Fields:
keyRings: The list of KeyRings.
nextPageToken: A token to retrieve next page of results. Pass this value
in ListKeyRingsRequest.page_token to retrieve the next page of results.
totalSize: The total number of KeyRings that matched the query. This field
is not populated if ListKeyRingsRequest.filter is applied.
r r TrP r r# r r
N)r r r r r r r: keyRingsrF r r r r r r r
r r r r
sK
#
#Iq4
@(''*-$$Q 0A0A0G0GH)r r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListLocationsResponsei,
zThe response message for Locations.ListLocations.
Fields:
locations: A list of locations that matches the specified filter in the
request.
nextPageToken: The standard List next-page token.
Locationr TrP r r
N) r r r r r r r: locationsrF r r r
r r r r ,
s- $$ZTB)''*-r r c x \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 " S S\R 5 5 r
\R " S5 r \R " SS 5 r\R " S
5 r\R " SS 5 r\R " S 5 rS
rg)r i9
aM A resource that represents a Google Cloud location.
Messages:
LabelsValue: Cross-service attributes for the location. For example
{"cloud.googleapis.com/region": "us-east1"}
MetadataValue: Service-specific metadata. For example the available
capacity at the given location.
Fields:
displayName: The friendly name for this location, typically a nearby city
name. For example, "Tokyo".
labels: Cross-service attributes for the location. For example
{"cloud.googleapis.com/region": "us-east1"}
locationId: The canonical id for this location. For example: `"us-east1"`.
metadata: Service-specific metadata. For example the available capacity at
the given location.
name: Resource name for the location, which may vary between
implementations. For example: `"projects/example-project/locations/us-
east1"`
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Location.LabelsValueiO
a Cross-service attributes for the location. For example
{"cloud.googleapis.com/region": "us-east1"}
Messages:
AdditionalProperty: An additional property for a LabelsValue object.
Fields:
additionalProperties: Additional properties of type LabelsValue
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)'Location.LabelsValue.AdditionalPropertyi[
r r r r
Nr r
r r r r [
r r r r TrP r
Nr r
r r r r O
r r r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Location.MetadataValueih
a Service-specific metadata. For example the available capacity at the
given location.
Messages:
AdditionalProperty: An additional property for a MetadataValue object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g))Location.MetadataValue.AdditionalPropertyiu
An additional property for a MetadataValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r extra_types.JsonValuer r
N r r r r r r rF r r: r r r
r r r r u
,
! !! $c$$%y~~ " Q #$$Q') q !$ ''(H!L/ --a0r r c \ rS rSrSr\R " S5 r\R " S5 r \R " S5 r
\R " S5 r Sr g) r" i
aS Request message for KeyManagementService.MacVerify.
Fields:
data: Required. The data used previously as a MacSignRequest.data to
generate the MAC tag.
dataCrc32c: Optional. An optional CRC32C checksum of the
MacVerifyRequest.data. If specified, KeyManagementService will verify
the integrity of the received MacVerifyRequest.data using this checksum.
KeyManagementService will report an error if the checksum verification
fails. If you receive a checksum error, your client should verify that
CRC32C(MacVerifyRequest.data) is equal to MacVerifyRequest.data_crc32c,
and if so, perform a limited number of retries. A persistent mismatch
may indicate an issue in your computation of the CRC32C checksum. Note:
This field is defined as int64 for reasons of compatibility across
different languages. However, it is a non-negative integer, which will
never exceed 2^32-1, and can be safely downconverted to uint32 in
languages that support this type.
mac: Required. The signature to verify.
macCrc32c: Optional. An optional CRC32C checksum of the
MacVerifyRequest.mac. If specified, KeyManagementService will verify the
integrity of the received MacVerifyRequest.mac using this checksum.
KeyManagementService will report an error if the checksum verification
fails. If you receive a checksum error, your client should verify that
CRC32C(MacVerifyRequest.mac) is equal to MacVerifyRequest.mac_crc32c,
and if so, perform a limited number of retries. A persistent mismatch
may indicate an issue in your computation of the CRC32C checksum. Note:
This field is defined as int64 for reasons of compatibility across
different languages. However, it is a non-negative integer, which will
never exceed 2^32-1, and can be safely downconverted to uint32 in
languages that support this type.
r r r# r$ r
N)
r r r r r r r r8 r r9 r r r r
r r r" r"
sJ @
a $%%a(* Q #$$Q')r r" c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r \R " S5 r
\R " S5 r\R " S 5 r\R " S
5 rS rg )
MacVerifyResponsei aZ Response message for KeyManagementService.MacVerify.
Enums:
ProtectionLevelValueValuesEnum: The ProtectionLevel of the
CryptoKeyVersion used for verification.
Fields:
name: The resource name of the CryptoKeyVersion used for verification.
Check this field to verify that the intended resource was used for
verification.
protectionLevel: The ProtectionLevel of the CryptoKeyVersion used for
verification.
success: This field indicates whether or not the verification operation
for MacVerifyRequest.mac over MacVerifyRequest.data was successful.
verifiedDataCrc32c: Integrity verification field. A flag indicating
whether MacVerifyRequest.data_crc32c was received by
KeyManagementService and used for the integrity verification of the
data. A false value of this field indicates either that
MacVerifyRequest.data_crc32c was left unset or that it was not delivered
to KeyManagementService. If you've set MacVerifyRequest.data_crc32c but
this field is still false, discard the response and perform a limited
number of retries.
verifiedMacCrc32c: Integrity verification field. A flag indicating whether
MacVerifyRequest.mac_crc32c was received by KeyManagementService and
used for the integrity verification of the data. A false value of this
field indicates either that MacVerifyRequest.mac_crc32c was left unset
or that it was not delivered to KeyManagementService. If you've set
MacVerifyRequest.mac_crc32c but this field is still false, discard the
response and perform a limited number of retries.
verifiedSuccessIntegrity: Integrity verification field. This value is used
for the integrity verification of [MacVerifyResponse.success]. If the
value of this field contradicts the value of
[MacVerifyResponse.success], discard the response and perform a limited
number of retries.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
0MacVerifyResponse.ProtectionLevelValueValuesEnumi3 a The ProtectionLevel of the CryptoKeyVersion used for verification.
Values:
PROTECTION_LEVEL_UNSPECIFIED: Not specified.
SOFTWARE: Crypto operations are performed in software.
HSM: Crypto operations are performed in a Hardware Security Module.
EXTERNAL: Crypto operations are performed by an external key manager.
EXTERNAL_VPC: Crypto operations are performed in an EKM-over-VPC
backend.
r r r r# r$ r
Nr% r
r r r+ r 3 r, r r+ r r r# r$ rD rE r
N)r r r r r r r- r+ rF rG r0 r1 r2 successrJ verifiedMacCrc32cverifiedSuccessIntegrityr r
r r r r s "Hy~~ "
q !$ ''(H!L/ " "1 %' --a0 ,,Q/ & 3 3A 6r r c z \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 " S S\R 5 5 r
\R " S5 r \R " S S
5 r\R " SS 5 r\R " S 5 r\R " SS
5 rSrg) OperationiL a This resource represents a long-running operation that is the result of
a network API call.
Messages:
MetadataValue: Service-specific metadata associated with the operation. It
typically contains progress information and common metadata such as
create time. Some services might not provide such metadata. Any method
that returns a long-running operation should document the metadata type,
if any.
ResponseValue: The normal, successful response of the operation. If the
original method returns no data on success, such as `Delete`, the
response is `google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
Fields:
done: If the value is `false`, it means the operation is still in
progress. If `true`, the operation is completed, and either `error` or
`response` is available.
error: The error result of the operation in case of failure or
cancellation.
metadata: Service-specific metadata associated with the operation. It
typically contains progress information and common metadata such as
create time. Some services might not provide such metadata. Any method
that returns a long-running operation should document the metadata type,
if any.
name: The server-assigned name, which is only unique within the same
service that originally returns it. If you use the default HTTP mapping,
the `name` should be a resource name ending with
`operations/{unique_id}`.
response: The normal, successful response of the operation. If the
original method returns no data on success, such as `Delete`, the
response is `google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Operation.MetadataValueiv a Service-specific metadata associated with the operation. It typically
contains progress information and common metadata such as create time.
Some services might not provide such metadata. Any method that returns a
long-running operation should document the metadata type, if any.
Messages:
AdditionalProperty: An additional property for a MetadataValue object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)*Operation.MetadataValue.AdditionalPropertyi r r r r r
Nr r
r r r r r r r r TrP r
Nr r
r r r r v s4 AY . . A %112FTXYr r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Operation.ResponseValuei a The normal, successful response of the operation. If the original
method returns no data on success, such as `Delete`, the response is
`google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
Messages:
AdditionalProperty: An additional property for a ResponseValue object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)*Operation.ResponseValue.AdditionalPropertyi zAn additional property for a ResponseValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r
Nr r
r r r r r r r r TrP r
Nr r
r r
ResponseValuer s4 AY . . A %112FTXYr r r Statusr r# r$ rD r
N)r r r r r r r r r r r r2 doner: errorr rF rG responser r
r r r r L s 'R !!"89Zi'' Z :Z6 !!"89 Zi'' Z : Z<
"$
1
-%
#
#OQ
7( q !$
#
#OQ
7(r r c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S 5 r
\R " S
\R R S 9rS rg
)Policyi aw An Identity and Access Management (IAM) policy, which specifies access
controls for Google Cloud resources. A `Policy` is a collection of
`bindings`. A `binding` binds one or more `members`, or principals, to a
single `role`. Principals can be user accounts, service accounts, Google
groups, and domains (such as G Suite). A `role` is a named list of
permissions; each `role` can be an IAM predefined role or a user-created
custom role. For some types of Google Cloud resources, a `binding` can also
specify a `condition`, which is a logical expression that allows access to a
resource only if the expression evaluates to `true`. A condition can add
constraints based on attributes of the request, the resource, or both. To
learn which resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies). **JSON example:** ``` { "bindings": [ { "role":
"roles/resourcemanager.organizationAdmin", "members": [
"user:mike@example.com", "group:admins@example.com", "domain:google.com",
"serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role":
"roles/resourcemanager.organizationViewer", "members": [
"user:eve@example.com" ], "condition": { "title": "expirable access",
"description": "Does not grant access after Sep 2020", "expression":
"request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag":
"BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: -
members: - user:mike@example.com - group:admins@example.com -
domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com
role: roles/resourcemanager.organizationAdmin - members: -
user:eve@example.com role: roles/resourcemanager.organizationViewer
condition: title: expirable access description: Does not grant access after
Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features,
see the [IAM documentation](https://cloud.google.com/iam/docs/).
Fields:
auditConfigs: Specifies cloud audit logging configuration for this policy.
bindings: Associates a list of `members`, or principals, with a `role`.
Optionally, may specify a `condition` that determines how and when the
`bindings` are applied. Each of the `bindings` must contain at least one
principal. The `bindings` in a `Policy` can refer to up to 1,500
principals; up to 250 of these principals can be Google groups. Each
occurrence of a principal counts towards these limits. For example, if
the `bindings` grant 50 different roles to `user:alice@example.com`, and
not to any other principal, then you can add another 1,450 principals to
the `bindings` in the `Policy`.
etag: `etag` is used for optimistic concurrency control as a way to help
prevent simultaneous updates of a policy from overwriting each other. It
is strongly suggested that systems make use of the `etag` in the read-
modify-write cycle to perform policy updates in order to avoid race
conditions: An `etag` is returned in the response to `getIamPolicy`, and
systems are expected to put that etag in the request to `setIamPolicy`
to ensure that their change will be applied to the same version of the
policy. **Important:** If you use IAM Conditions, you must include the
`etag` field whenever you call `setIamPolicy`. If you omit this field,
then IAM allows you to overwrite a version `3` policy with a version `1`
policy, and all of the conditions in the version `3` policy are lost.
version: Specifies the format of the policy. Valid values are `0`, `1`,
and `3`. Requests that specify an invalid value are rejected. Any
operation that affects conditional role bindings must specify version
`3`. This requirement applies to the following operations: * Getting a
policy that includes a conditional role binding * Adding a conditional
role binding to a policy * Changing a conditional role binding in a
policy * Removing any role binding, with or without a condition, from a
policy that includes conditions **Important:** If you use IAM
Conditions, you must include the `etag` field whenever you call
`setIamPolicy`. If you omit this field, then IAM allows you to overwrite
a version `3` policy with a version `1` policy, and all of the
conditions in the version `3` policy are lost. If a policy does not
include any conditions, operations on that policy may specify any valid
version or leave the field unset. To learn which resources support
conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
rM r TrP rm r r# r$ r r
N)r r r r r r r: auditConfigsbindingsr ri r r r versionr r
r r r r sa EN ''
q4H,
#
#Iq4
@( a $ " "1i.?.?.E.E F'r r c \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r \R " SS 5 r \R " S
5 r
\R " S 5 r\R " S 5 r\R " SS
5 r\R$ " SS5 r\R " SS5 rSrg) PublicKeyi a The public keys for a given CryptoKeyVersion. Obtained via GetPublicKey.
Enums:
AlgorithmValueValuesEnum: The Algorithm associated with this key.
ProtectionLevelValueValuesEnum: The ProtectionLevel of the
CryptoKeyVersion public key.
PublicKeyFormatValueValuesEnum: The PublicKey format specified by the
customer through the public_key_format field.
Fields:
algorithm: The Algorithm associated with this key.
name: The name of the CryptoKeyVersion public key. Provided here for
verification. NOTE: This field is in Beta.
pem: The public key, encoded in PEM format. For more information, see the
[RFC 7468](https://tools.ietf.org/html/rfc7468) sections for [General
Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
[Textual Encoding of Subject Public Key Info]
(https://tools.ietf.org/html/rfc7468#section-13).
pemCrc32c: Integrity verification field. A CRC32C checksum of the returned
PublicKey.pem. An integrity check of PublicKey.pem can be performed by
computing the CRC32C checksum of PublicKey.pem and comparing your
results to this field. Discard the response in case of non-matching
checksum values, and perform a limited number of retries. A persistent
mismatch may indicate an issue in your computation of the CRC32C
checksum. Note: This field is defined as int64 for reasons of
compatibility across different languages. However, it is a non-negative
integer, which will never exceed `2^32-1`, and can be safely
downconverted to uint32 in languages that support this type. NOTE: This
field is in Beta.
protectionLevel: The ProtectionLevel of the CryptoKeyVersion public key.
publicKey: This field contains the public key (with integrity
verification), formatted according to the public_key_format field.
publicKeyFormat: The PublicKey format specified by the customer through
the public_key_format field.
c \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrSrSrSrSrSrSrSrSr Sr S r S r S r S r!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0S/r1g0)1"PublicKey.AlgorithmValueValuesEnumi+ ao The Algorithm associated with this key.
Values:
CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED: Not specified.
GOOGLE_SYMMETRIC_ENCRYPTION: Creates symmetric encryption keys.
AES_128_GCM: AES-GCM (Galois Counter Mode) using 128-bit keys.
AES_256_GCM: AES-GCM (Galois Counter Mode) using 256-bit keys.
AES_128_CBC: AES-CBC (Cipher Block Chaining Mode) using 128-bit keys.
AES_256_CBC: AES-CBC (Cipher Block Chaining Mode) using 256-bit keys.
AES_128_CTR: AES-CTR (Counter Mode) using 128-bit keys.
AES_256_CTR: AES-CTR (Counter Mode) using 256-bit keys.
RSA_SIGN_PSS_2048_SHA256: RSASSA-PSS 2048 bit key with a SHA256 digest.
RSA_SIGN_PSS_3072_SHA256: RSASSA-PSS 3072 bit key with a SHA256 digest.
RSA_SIGN_PSS_4096_SHA256: RSASSA-PSS 4096 bit key with a SHA256 digest.
RSA_SIGN_PSS_4096_SHA512: RSASSA-PSS 4096 bit key with a SHA512 digest.
RSA_SIGN_PKCS1_2048_SHA256: RSASSA-PKCS1-v1_5 with a 2048 bit key and a
SHA256 digest.
RSA_SIGN_PKCS1_3072_SHA256: RSASSA-PKCS1-v1_5 with a 3072 bit key and a
SHA256 digest.
RSA_SIGN_PKCS1_4096_SHA256: RSASSA-PKCS1-v1_5 with a 4096 bit key and a
SHA256 digest.
RSA_SIGN_PKCS1_4096_SHA512: RSASSA-PKCS1-v1_5 with a 4096 bit key and a
SHA512 digest.
RSA_SIGN_RAW_PKCS1_2048: RSASSA-PKCS1-v1_5 signing without encoding,
with a 2048 bit key.
RSA_SIGN_RAW_PKCS1_3072: RSASSA-PKCS1-v1_5 signing without encoding,
with a 3072 bit key.
RSA_SIGN_RAW_PKCS1_4096: RSASSA-PKCS1-v1_5 signing without encoding,
with a 4096 bit key.
RSA_DECRYPT_OAEP_2048_SHA256: RSAES-OAEP 2048 bit key with a SHA256
digest.
RSA_DECRYPT_OAEP_3072_SHA256: RSAES-OAEP 3072 bit key with a SHA256
digest.
RSA_DECRYPT_OAEP_4096_SHA256: RSAES-OAEP 4096 bit key with a SHA256
digest.
RSA_DECRYPT_OAEP_4096_SHA512: RSAES-OAEP 4096 bit key with a SHA512
digest.
RSA_DECRYPT_OAEP_2048_SHA1: RSAES-OAEP 2048 bit key with a SHA1 digest.
RSA_DECRYPT_OAEP_3072_SHA1: RSAES-OAEP 3072 bit key with a SHA1 digest.
RSA_DECRYPT_OAEP_4096_SHA1: RSAES-OAEP 4096 bit key with a SHA1 digest.
EC_SIGN_P256_SHA256: ECDSA on the NIST P-256 curve with a SHA256 digest.
Other hash functions can also be used:
https://cloud.google.com/kms/docs/create-validate-
signatures#ecdsa_support_for_other_hash_algorithms
EC_SIGN_P384_SHA384: ECDSA on the NIST P-384 curve with a SHA384 digest.
Other hash functions can also be used:
https://cloud.google.com/kms/docs/create-validate-
signatures#ecdsa_support_for_other_hash_algorithms
EC_SIGN_SECP256K1_SHA256: ECDSA on the non-NIST secp256k1 curve. This
curve is only supported for HSM protection level. Other hash functions
can also be used: https://cloud.google.com/kms/docs/create-validate-
signatures#ecdsa_support_for_other_hash_algorithms
EC_SIGN_ED25519: EdDSA on the Curve25519 in pure mode (taking data as
input).
HMAC_SHA256: HMAC-SHA256 signing with a 256 bit key.
HMAC_SHA1: HMAC-SHA1 signing with a 160 bit key.
HMAC_SHA384: HMAC-SHA384 signing with a 384 bit key.
HMAC_SHA512: HMAC-SHA512 signing with a 512 bit key.
HMAC_SHA224: HMAC-SHA224 signing with a 224 bit key.
EXTERNAL_SYMMETRIC_ENCRYPTION: Algorithm representing symmetric
encryption by an external key manager.
ML_KEM_768: ML-KEM-768 (FIPS 203)
ML_KEM_1024: ML-KEM-1024 (FIPS 203)
KEM_XWING: X-Wing hybrid KEM combining ML-KEM-768 with X25519 following
datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.
PQ_SIGN_ML_DSA_44: The post-quantum Module-Lattice-Based Digital
Signature Algorithm, at security level 1. Randomized version.
PQ_SIGN_ML_DSA_65: The post-quantum Module-Lattice-Based Digital
Signature Algorithm, at security level 3. Randomized version.
PQ_SIGN_ML_DSA_87: The post-quantum Module-Lattice-Based Digital
Signature Algorithm, at security level 5. Randomized version.
PQ_SIGN_SLH_DSA_SHA2_128S: The post-quantum stateless hash-based digital
signature algorithm, at security level 1. Randomized version.
PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256: The post-quantum stateless hash-
based digital signature algorithm, at security level 1. Randomized
pre-hash version supporting SHA256 digests.
r r r r# r$ rD rE rt ru rv r r r r r r r r r
r r r r r r r r r r r r r r r r r r r r r r r r r r
Nr r
r r r r + s LZ 01,"# KKKKKK ! ! !# !# !# !# #% #% #% #% !# !# !# ! OKIKKK$&!JKI " ,.)r r c , \ rS rSrSrSrSrSrSrSr Sr
g )
(PublicKey.ProtectionLevelValueValuesEnumi a The ProtectionLevel of the CryptoKeyVersion public key.
Values:
PROTECTION_LEVEL_UNSPECIFIED: Not specified.
SOFTWARE: Crypto operations are performed in software.
HSM: Crypto operations are performed in a Hardware Security Module.
EXTERNAL: Crypto operations are performed by an external key manager.
EXTERNAL_VPC: Crypto operations are performed in an EKM-over-VPC
backend.
r r r r# r$ r
Nr% r
r r r+ r r, r r+ c , \ rS rSrSrSrSrSrSrSr Sr
g )
(PublicKey.PublicKeyFormatValueValuesEnumi a The PublicKey format specified by the customer through the
public_key_format field.
Values:
PUBLIC_KEY_FORMAT_UNSPECIFIED: If the public_key_format field is not
specified: - For PQC algorithms, an error will be returned. - For non-
PQC algorithms, the default format is PEM, and the field pem will be
populated. Otherwise, the public key will be exported through the
public_key field in the requested format.
PEM: The returned public key will be encoded in PEM format. See the
[RFC7468](https://tools.ietf.org/html/rfc7468) sections for [General
Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
[Textual Encoding of Subject Public Key Info]
(https://tools.ietf.org/html/rfc7468#section-13) for more information.
DER: The returned public key will be encoded in DER format (the
PrivateKeyInfo structure from RFC 5208).
NIST_PQC: This is supported only for PQC algorithms. The key material is
returned in the format defined by NIST PQC standards (FIPS 203, FIPS
204, and FIPS 205).
XWING_RAW_BYTES: The returned public key is in raw bytes format defined
in its standard https://datatracker.ietf.org/doc/draft-connolly-cfrg-
xwing-kem.
r r r r# r$ r
Nr r
r r r
r s# . %&!
C
CHOr r
r r r# r$ rD r rE rt r
N)r r r r r r r- r r+ r
r0 r
rF rG pemr pemCrc32cr1 r: rm r r r
r r r r s "Hy/ y/vy~~ " y~~ < !!" \ rS rSrSr\R " SS5 rSrg)8ShowEffectiveKeyAccessJustificationsPolicyConfigResponsei^ zResponse message for KeyAccessJustificationsConfig.ShowEffectiveKeyAcces
sJustificationsPolicyConfig.
Fields:
effectiveKajPolicy: The effective KeyAccessJustificationsPolicyConfig.
r r r
N) r r r r r r r: effectiveKajPolicyr r
r r r
r
^ s !--.SUVWr r
c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " S5 r \R " SS S
S 9r
\R " S 5 r\R " S
5 r\R " S5 r\R " S5 r\R$ " SSS 9r\R " S5 r\R " S5 r\R " S5 r\R " S5 rSrg)StandardQueryParametersii a Query parameters accepted by all methods.
Enums:
FXgafvValueValuesEnum: V1 error format.
AltValueValuesEnum: Data format for response.
Fields:
f__xgafv: V1 error format.
access_token: OAuth access token.
alt: Data format for response.
callback: JSONP
fields: Selector specifying which fields to include in a partial response.
key: API key. Your API key identifies your project and provides you with
API access, quota, and reports. Required unless you provide an OAuth 2.0
token.
oauth_token: OAuth 2.0 token for the current user.
prettyPrint: Returns response with indentations and line breaks.
quotaUser: Available to use for quota purposes for server-side
applications. Can be any arbitrary string assigned to a user, but should
not exceed 40 characters.
trace: A tracing token of the form "token:" to include in api
requests.
uploadType: Legacy upload protocol for media (e.g. "media", "multipart").
upload_protocol: Upload protocol for media (e.g. "raw", "multipart").
c $ \ rS rSrSrSrSrSrSrg)*StandardQueryParameters.AltValueValuesEnumi zData format for response.
Values:
json: Responses with Content-Type of application/json
media: Media download with context-dependent Content-Type
proto: Responses with Content-Type of application/x-protobuf
r r r r
N) r r r r r jsonmediaprotor r
r r AltValueValuesEnumr s
D
E
Er r c \ rS rSrSrSrSrSrg)-StandardQueryParameters.FXgafvValueValuesEnumi zFV1 error format.
Values:
_1: v1 error format
_2: v2 error format
r r r
N)r r r r r _1_2r r
r r FXgafvValueValuesEnumr s
B
Br r r r r# r )defaultr$ rD rE rt ru Trv r r r r
N)r r r r r r r- r r r0 f__xgafvrF access_tokenaltcallbackfieldsr oauth_tokenr2 prettyPrint quotaUsertrace
uploadTypeupload_protocolr r
r r r r i s 4
9>>
inn
!8!
<(&&q), 0!VD#
"
"1
%( #& a #%%a(+&&q$7+##A&)
#%$$R(* ))"-/r r c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S\R R S9r
\R " SSS S
9r\R " S 5 rS rg
)r i a The `Status` type defines a logical error model that is suitable for
different programming environments, including REST APIs and RPC APIs. It is
used by [gRPC](https://github.com/grpc). Each `Status` message contains
three pieces of data: error code, error message, and error details. You can
find out more about this error model and how to work with it in the [API
Design Guide](https://cloud.google.com/apis/design/errors).
Messages:
DetailsValueListEntry: A DetailsValueListEntry object.
Fields:
code: The status code, which should be an enum value of google.rpc.Code.
details: A list of messages that carry the error details. There is a
common set of message types for APIs to use.
message: A developer-facing error message, which should be in English. Any
user-facing error message should be localized and sent in the
google.rpc.Status.details field, or localized by the client.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Status.DetailsValueListEntryi zA DetailsValueListEntry object.
Messages:
AdditionalProperty: An additional property for a DetailsValueListEntry
object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)/Status.DetailsValueListEntry.AdditionalPropertyi zAn additional property for a DetailsValueListEntry object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r
Nr r
r r r r, r r r r TrP r
Nr r
r r DetailsValueListEntryr* r r r- r r r TrP r# r
N)r r r r r r r r r r- r r r coder: detailsrF messager r
r r r r s| & !!"89Zi / / Z :Z2
9+<+<+B+B C$ " "#:A M' ! !! $'r r c : \ rS rSrSr\R " SSS9rSrg)r i a3 Request message for `TestIamPermissions` method.
Fields:
permissions: The set of permissions to check for the `resource`.
Permissions with wildcards (such as `*` or `storage.*`) are not allowed.
For more information see [IAM
Overview](https://cloud.google.com/iam/docs/overview#permissions).
r TrP r
N r r r r r r rF permissionsr r
r r r r s %%a$7+r r c : \ rS rSrSr\R " SSS9rSrg)TestIamPermissionsResponsei zResponse message for `TestIamPermissions` method.
Fields:
permissions: A subset of `TestPermissionsRequest.permissions` that the
caller is allowed.
r TrP r
Nr2 r
r r r5 r5 s %%a$7+r r5 c < \ rS rSrSr\R " S5 rSrg)rN i zRequest message for KeyManagementService.UpdateCryptoKeyPrimaryVersion.
Fields:
cryptoKeyVersionId: Required. The id of the child CryptoKeyVersion to use
as primary.
r r
N) r r r r r r rF cryptoKeyVersionIdr r
r r rN rN s !,,Q/r rN c \ rS rSrSrSrg)VerifyConnectivityResponsei z3Response message for EkmService.VerifyConnectivity.r
Nr* r
r r r9 r9 s rM rO ra rm rs r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r
r r r r! r% r' r, r0 r4 r8 r< r> r@ rF rI rK rM rQ rS rU rZ r\ r^ ra rc re rg ri rk rn rp rt rv r{ r} r r r r r r5 r% r r7 rq r r9 r? rn r r rQ r rV ro r r r r r r r r r r r r r r r r r" r r r r r( r r- r r1 r9 r r r r
r r r r5 rN r9 ri AddCustomJsonFieldMappingAddCustomJsonEnumMappingr r
r r rC s- ' < % ( /y 0 0 /257 1 1 57p'+I - - '+T@3Y . . @3F%)## %: =Y&& =D.9I%% .9bT"i T"n G)## GDA )) A$!i'' !,1Y->-> 11y/@/@ 1( 0A0A ("()2C2C ("1Y5F5F 1( 8I8I ("1 0A0A 15IO>O (
IYEVEV
I U9K\K\ U" kYM^M^ k 59;L;L 541)2C2C 1 3y?P?P 3 5YEVEV 541I ! !114> " "9;[]} " ">@` cCD " "8:Z\|~ " "BDd gGH " "BDd gGHr