SrSSKJr SSKJr SSKJr SSKJr Sr "SS\R5r "S S \R5r "S S \R5r "S S\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS \R5r"S!S"\R5r"S#S$\R5r"S%S&\R5r"S'S(\R5r"S)S*\R5r"S+S,\R5r"S-S.\R5r"S/S0\R5r"S1S2\R5r "S3S4\R5r!"S5S6\R5r""S7S8\R5r#"S9S:\R5r$\RJ"\$S;S<5 \RL"\$RNS=S>5 \RL"\$RNS?S@5 gA)BaGenerated message classes for iam version v2. Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. )absolute_import)messages)encoding) extra_typesiamc\rSrSrSr"SS\R 5r\R"S5r \R"SS5r Sr g) \rSrSrSr\R "SS5rSrg)GoogleIamAdminV1AuditDataPzAudit log information specific to Cloud IAM admin APIs. This message is serialized as an `Any` type in the `ServiceData` message of an `AuditLog` message. Fields: permissionDelta: The permission_delta when when creating or updating a Role. (GoogleIamAdminV1AuditDataPermissionDeltarrN) rrrrrr MessageFieldpermissionDeltarrrrr4r4Ps**+UWXY/rr4c\\rSrSrSr\R "SSS9r\R "SSS9rSr g) r6]zA PermissionDelta message to record the added_permissions and removed_permissions inside a role. Fields: addedPermissions: Added permissions. removedPermissions: Removed permissions. rTrepeatedrrN) rrrrrrr+addedPermissionsremovedPermissionsrrrrr6r6]s/**1t< ,,Q>rr6c\rSrSrSr"SS\R 5r\R"SS5r \R"SS5r \R"S5r \R"S 5rS rg ) GoogleIamV1BindingDeltajaZOne delta entry for Binding. Each individual change (only one member in each entry) to a binding will be a separate entry. Enums: ActionValueValuesEnum: The action that was performed on a Binding. Required Fields: action: The action that was performed on a Binding. Required condition: The condition that is associated with this binding. member: A single identity requesting access for a Google Cloud resource. Follows the same format of Binding.members. Required role: Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required c$\rSrSrSrSrSrSrSrg)-GoogleIamV1BindingDelta.ActionValueValuesEnum{zThe action that was performed on a Binding. Required Values: ACTION_UNSPECIFIED: Unspecified. ADD: Addition of a Binding. REMOVE: Removal of a Binding. rrrrN) rrrrrACTION_UNSPECIFIEDADDREMOVErrrrActionValueValuesEnumrC{s C FrrHrGoogleTypeExprrr&r'rN)rrrrrrrrHr!actionr7 conditionr+memberrolerrrrr@r@js_ inn    6 :&$$%5q9)   #&   q !$rr@c>\rSrSrSr\R "SS5rSrg)GoogleIamV1LoggingAuditDatazAudit log information specific to Cloud IAM. This message is serialized as an `Any` type in the `ServiceData` message of an `AuditLog` message. Fields: policyDelta: Policy delta between the original policy and the newly set policy. GoogleIamV1PolicyDeltarrN) rrrrrrr7 policyDeltarrrrrOrOs&&'?C+rrOc<\rSrSrSr\R "SSSS9rSrg) rQzrThe difference delta between two policies. Fields: bindingDeltas: The delta for Bindings between two policies. r@rTr;rN) rrrrrrr7 bindingDeltasrrrrrQrQs (()BAPTU-rrQc\rSrSrSrSrg)4GoogleIamV1betaWorkloadIdentityPoolOperationMetadataz:Metadata for long-running WorkloadIdentityPool operations.rN)rrrrrrrrrrWrWsCrrWc\rSrSrSr\R "SS5r\R"SSS9r \R"SSS9r \R"S SS9r \R"S SS9r S r g ) GoogleIamV2DenyRulea-A deny rule in an IAM deny policy. Fields: denialCondition: The condition that determines whether this deny rule applies to a request. If the condition expression evaluates to `true`, then the deny rule is applied; otherwise, the deny rule is not applied. Each deny rule is evaluated independently. If this deny rule does not apply to a request, other deny rules might still apply. The condition can use CEL functions that evaluate [resource tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other functions and operators are not supported. deniedPermissions: The permissions that are explicitly denied by this rule. Each permission uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`. deniedPrincipals: The identities that are prevented from using one or more permissions on Google Cloud resources. This field can contain the following values: * `principal://goog/subject/{email_id}`: A specific Google Account. Includes Gmail, Cloud Identity, and Google Workspace user accounts. For example, `principal://goog/subject/alice@example.com`. * `principal://iam.googlea pis.com/projects/-/serviceAccounts/{service_account_id}`: A Google Cloud service account. For example, `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service- account@iam.gserviceaccount.com`. * `principalSet://goog/group/{group_id}`: A Google group. For example, `principalSet://goog/group/admins@example.com`. * `principalSet://goog/public:all`: A special identifier that represents any principal that is on the internet, even if they do not have a Google Account or are not logged in. * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the principals associated with the specified Google Workspace or Cloud Identity customer ID. For example, `principalSet://goog/cloudIdentityCustomerId/C01Abc35`. * `principal://i am.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{sub ject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{po ol_id}/group/{group_id}`: All workforce identities in a group. * `princi palSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/at tribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/lo cations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{pro ject_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{s ubject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations /global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{proj ect_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{ attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis .com/projects/{project_number}/locations/global/workloadIdentityPools/{p ool_id}/*`: All identities in a workload identity pool. * `principalSet: //cloudresourcemanager.googleapis.com/[projects|folders|organizations]/{ project_number|folder_number|org_number}/type/ServiceAccount`: All service accounts grouped under a resource (project, folder, or organization). * `principalSet://cloudresourcemanager.googleapis.com/[pr ojects|folders|organizations]/{project_number|folder_number|org_number}/ type/ServiceAgent`: All service agents grouped under a resource (project, folder, or organization). * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific Google Account that was deleted recently. For example, `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If the Google Account is recovered, this identifier reverts to the standard identifier for a Google Account. * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group that was deleted recently. For example, `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`. If the Google group is restored, this identifier reverts to the standard identifier for a Google group. * `deleted:principal://iam.googleapis.com /projects/-/serviceAccounts/{service_account_id}?uid={uid}`: A Google Cloud service account that was deleted recently. For example, `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my- service-account@iam.gserviceaccount.com?uid=1234567890`. If the service account is undeleted, this identifier reverts to the standard identifier for a service account. * `deleted:principal://iam.googleapis.com/locatio ns/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `dele ted:principal://iam.googleapis.com/locations/global/workforcePools/my- pool-id/subject/my-subject-attribute-value`. exceptionPermissions: Specifies the permissions that this rule excludes from the set of denied permissions given by `denied_permissions`. If a permission appears in `denied_permissions` _and_ in `exception_permissions` then it will _not_ be denied. The excluded permissions can be specified using the same syntax as `denied_permissions`. exceptionPrincipals: The identities that are excluded from the deny rule, even if they are listed in the `denied_principals`. For example, you could add a Google group to the `denied_principals`, then exclude specific users who belong to that group. This field can contain the same values as the `denied_principals` field, excluding `principalSet://goog/public:all`, which represents all users on the internet. rIrrTr;r&r'r(rN)rrrrrrr7denialConditionr+deniedPermissionsdeniedPrincipalsexceptionPermissionsexceptionPrincipalsrrrrrZrZsj^@**+;Q?/++A=**1t<"..q4@!--a$?rrZc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) GoogleIamV2ListPoliciesResponseiaResponse message for `ListPolicies`. Fields: nextPageToken: A page token that you can use in a ListPoliciesRequest to retrieve the next page. If this field is omitted, there are no additional pages. policies: Metadata for the policies that are attached to the resource. rGoogleIamV2PolicyrTr;rN) rrrrrrr+ nextPageTokenr7policiesrrrrrbrbs.''*-  # #$7T J(rrbc\rSrSrSr\R "S5"SS\R55r \R"SS5r \R"S5r \R"S5r\R"S 5r\R"S 5r\R"S 5r\R"S 5r\R"S 5r\R"SSSS9r\R"S5r\R"S5rSrg)rcia>Data for an IAM policy. Messages: AnnotationsValue: A key-value map to store arbitrary metadata for the `Policy`. Keys can be up to 63 characters. Values can be up to 255 characters. Fields: annotations: A key-value map to store arbitrary metadata for the `Policy`. Keys can be up to 63 characters. Values can be up to 255 characters. createTime: Output only. The time when the `Policy` was created. deleteTime: Output only. The time when the `Policy` was deleted. Empty if the policy is not deleted. displayName: A user-specified description of the `Policy`. This value can be up to 63 characters. etag: An opaque tag that identifies the current version of the `Policy`. IAM uses this value to help manage concurrent updates, so they do not cause one update to be overwritten by another. If this field is present in a CreatePolicyRequest, the value is ignored. kind: Output only. The kind of the `Policy`. Always contains the value `DenyPolicy`. managingAuthority: Immutable. Specifies that this policy is managed by an authority and can only be modified by that authority. Usage is restricted. name: Immutable. The resource name of the `Policy`, which must be unique. Format: `policies/{attachment_point}/denypolicies/{policy_id}` The attachment point is identified by its URL-encoded full resource name, which means that the forward-slash character, `/`, must be written as `%2F`. For example, `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy- project/denypolicies/my-deny-policy`. For organizations and folders, use the numeric ID in the full resource name. For projects, requests can use the alphanumeric or the numeric ID. Responses always contain the numeric ID. rules: A list of rules that specify the behavior of the `Policy`. All of the rules should be of the `kind` specified in the `Policy`. uid: Immutable. The globally unique ID of the `Policy`. Assigned automatically when the `Policy` is created. updateTime: Output only. The time when the `Policy` was last updated. additionalPropertiescf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) "GoogleIamV2Policy.AnnotationsValueiGa.A key-value map to store arbitrary metadata for the `Policy`. Keys can be up to 63 characters. Values can be up to 255 characters. Messages: AdditionalProperty: An additional property for a AnnotationsValue object. Fields: additionalProperties: Additional properties of type AnnotationsValue c`\rSrSrSr\R "S5r\R "S5rSr g)5GoogleIamV2Policy.AnnotationsValue.AdditionalPropertyiTzAn additional property for a AnnotationsValue object. Fields: key: Name of the additional property. value: A string attribute. rrrN) rrrrrrr+keyvaluerrrrAdditionalPropertyrkTs)   ! !! $c##A&errnrTr;rN rrrrrrMessagernr7rgrrrrAnnotationsValueriGs2  'Y.. '%112FTXYrrqrrr&r'r(r)r*GoogleIamV2PolicyRule Tr; rN)rrrrrrMapUnrecognizedFieldsrrprqr7 annotationsr+r. deleteTime displayNameetagkindmanagingAuthoritynamerulesuid updateTimerrrrrcrcs'R !!"89Z**Z:Z2&&'91=+$$Q'*$$Q'*%%a(+   q !$   q !$++A.   q !$  !8!d K%b!#$$R(*rrcc<\rSrSrSr\R "S5rSrg)"GoogleIamV2PolicyOperationMetadatainzMetadata for long-running `Policy` operations. Fields: createTime: Timestamp when the `google.longrunning.Operation` was created. rrN) rrrrrrr+r.rrrrrrns $$Q'*rrcb\rSrSrSr\R "SS5r\R"S5r Sr g)rsixzA single rule in a `Policy`. Fields: denyRule: A rule for a deny policy. description: A user-specified description of the rule. This value can be up to 256 characters. rZrrrN) rrrrrrr7denyRuler+ descriptionrrrrrsrsxs, # #$91 =(%%a(+rrsc\rSrSrSr\R "S5r\R "S5r\R "S5r \R"S5r \R "S5r \R "S5r \R "S 5rS rg ) GoogleIamV3OperationMetadataiRepresents the metadata of the long-running operation. Fields: apiVersion: Output only. API version used to start the operation. createTime: Output only. The time the operation was created. endTime: Output only. The time the operation finished running. requestedCancellation: Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`. statusMessage: Output only. Human-readable status of the operation, if any. target: Output only. Server-defined resource path for the target of the verb: Output only. Name of the verb executed by the operation. rrr&r'r(r)r*rNrrrrrrr+r,r.r/rrequestedCancellation statusMessager1r2rrrrrrz $$Q'*$$Q'*  ! !! $'#003''*-   #&   q !$rrc\rSrSrSr\R "S5r\R "S5r\R "S5r \R"S5r \R "S5r \R "S5r \R "S 5rS rg ) !GoogleIamV3alphaOperationMetadatairrrr&r'r(r)r*rNrrrrrrrrrc\rSrSrSr\R "S5r\R "S5r\R "S5r \R"S5r \R "S5r \R "S5r \R "S 5rS rg ) GoogleIamV3betaOperationMetadatairrrr&r'r(r)r*rNrrrrrrrrrc\rSrSrSr\R "S5r\R "S5r\R "S5r \R"S5r \R "S5r \R "S5r \R "S 5rS rg ) GoogleIamV3mainOperationMetadatairrrr&r'r(r)r*rNrrrrrrrrrcz\rSrSrSr\R "S5"SS\R55r \R "S5"SS\R55r \R"S5r \R"S S 5r\R"SS 5r\R "S 5r\R"SS 5rSrg)GoogleLongrunningOperationiaThis resource represents a long-running operation that is the result of a network API call. Messages: MetadataValue: Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. ResponseValue: The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. Fields: done: If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. error: The error result of the operation in case of failure or cancellation. metadata: Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. name: The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. response: The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. rgcf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) (GoogleLongrunningOperation.MetadataValueiaService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. Messages: AdditionalProperty: An additional property for a MetadataValue object. Fields: additionalProperties: Properties of the object. Contains field @type with type URL. cb\rSrSrSr\R "S5r\R"SS5r Sr g);GoogleLongrunningOperation.MetadataValue.AdditionalPropertyi&zAn additional property for a MetadataValue object. Fields: key: Name of the additional property. value: A extra_types.JsonValue attribute. rextra_types.JsonValuerrN rrrrrrr+rlr7rmrrrrrnr&,   ! !! $c$$%" to include in api requests. uploadType: Legacy upload protocol for media (e.g. "media", "multipart"). upload_protocol: Upload protocol for media (e.g. "raw", "multipart"). c$\rSrSrSrSrSrSrSrg)*StandardQueryParameters.AltValueValuesEnumi/zData format for response. Values: json: Responses with Content-Type of application/json media: Media download with context-dependent Content-Type proto: Responses with Content-Type of application/x-protobuf rrrrN) rrrrrjsonmediaprotorrrrAltValueValuesEnumr/s D E Errc \rSrSrSrSrSrSrg)-StandardQueryParameters.FXgafvValueValuesEnumi;zFV1 error format. Values: _1: v1 error format _2: v2 error format rrrN)rrrrr_1_2rrrrFXgafvValueValuesEnumr;s B Brrrrr&r)defaultr'r(r)r*rrTrtrurv rN)rrrrrrrrrr!f__xgafvr+ access_tokenaltcallbackfieldsrl oauth_tokenr prettyPrint quotaUsertrace uploadTypeupload_protocolrrrrrrs4 9>>  inn  !8! <(&&q),0!VD#  " "1 %(   #&a #%%a(+&&q$7+##A&)    #%$$R(*))"-/rrrz$.xgafvr1r2N)(r __future__rapitools.base.protorpcliterrapitools.base.pyrrpackagerpr r$r4r6r@rOrQrWrZrbrcrrsrrrrrrrIrrrrrrAddCustomJsonFieldMappingAddCustomJsonEnumMappingrrrrrs\'<%( M9CTCTMB"):):"4 Z 1 1 Z ?y/@/@ ? "i// "F D)"3"3 DVY..VD9;L;LDe@)++e@P Ki&7&7 KN) ))N)b():):( )I-- )"9#4#4"4" (9(9"4"y'8'8"4"y'8'8"4i8!2!2i8X0%i''0%f!#Y&&!#H&Y%6%6&61y001,1I--1"3Y%6%6301i&7&71<.i//<.~ ""Z4!!114>!!114>r