+ projects()
+
Returns the projects Resource.
+ +
+ close()
Close httplib2 connections.
+ +Create a BatchHttpRequest object based on the discovery document.
+close()
+ Close httplib2 connections.+
new_batch_http_request()
+ Create a BatchHttpRequest object based on the discovery document. + + Args: + callback: callable, A callback to be called for each response, of the + form callback(id, response, exception). The first parameter is the + request id, and the second is the deserialized response object. The + third is an apiclient.errors.HttpError exception object if an HTTP + error occurred while processing the request, or None if no error + occurred. + + Returns: + A BatchHttpRequest object based on the discovery document. ++
+ locations()
+
Returns the locations Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ close()
Close httplib2 connections.
+ +Gets details of a single AccessSummary.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists AccessSummaries in a given project and location. Supported Filters: - `workload_id`: Filter by the SPIFFE ID of the agent. Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Gets details of a single AccessSummary.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AccessSummary object
+ "authProvider": "A String", # Output only. The auth_provider that this access summary is associated with.
+ "authProviderType": "A String", # Output only. The type of the connector that was used to create this access summary.
+ "firstAccessTime": "A String", # Output only. The first time this user has interacted with this workload. Rounded to the previous hour.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "lastAccessTime": "A String", # Output only. The most recent time this user has interacted with this workload. Rounded to the previous hour.
+ "name": "A String", # Output only. Identifier. Name of the AccessSummary
+ "purgeTime": "A String", # Output only. The time when this access summary is permanently deleted.
+ "scopes": [ # Output only. All scopes that have been used by this user with this workload. The number of scopes is limited to 200.
+ "A String",
+ ],
+ "tokenUrl": "A String", # Output only. The url of the authentication server that was accessed.
+ "userId": "A String", # Output only. The user_id provided by the workload application for this user. Not verified by Google.
+ "workloadId": "A String", # Output only. The identity bound to the workload that this user interacted with to produce this AccessSummary. Will typically be an agentic spiffe id
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists AccessSummaries in a given project and location. Supported Filters: - `workload_id`: Filter by the SPIFFE ID of the agent. Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ filter: string, Optional. Filter string to restrict the results. Currently supports filtering by `workload_id` or `auth_provider_name`. If no filter is provided, returns all access summaries for the requested project and location. Format: `workload_id=""` or `auth_provider_name=""`
+ orderBy: string, Optional. This field is currently ignored. Defaults to ordering by (auth_provider_id, user_id) in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token identifying a page of results the server should return.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing AccessSummaries
+ "accessSummaries": [ # The list of AccessSummary
+ { # Message describing AccessSummary object
+ "authProvider": "A String", # Output only. The auth_provider that this access summary is associated with.
+ "authProviderType": "A String", # Output only. The type of the connector that was used to create this access summary.
+ "firstAccessTime": "A String", # Output only. The first time this user has interacted with this workload. Rounded to the previous hour.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "lastAccessTime": "A String", # Output only. The most recent time this user has interacted with this workload. Rounded to the previous hour.
+ "name": "A String", # Output only. Identifier. Name of the AccessSummary
+ "purgeTime": "A String", # Output only. The time when this access summary is permanently deleted.
+ "scopes": [ # Output only. All scopes that have been used by this user with this workload. The number of scopes is limited to 200.
+ "A String",
+ ],
+ "tokenUrl": "A String", # Output only. The url of the authentication server that was accessed.
+ "userId": "A String", # Output only. The user_id provided by the workload application for this user. Not verified by Google.
+ "workloadId": "A String", # Output only. The identity bound to the workload that this user interacted with to produce this AccessSummary. Will typically be an agentic spiffe id
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ close()
Close httplib2 connections.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a single Authorization.
+ +Gets details of a single Authorization.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists Authorizations in a given project and location.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
delete(name, requestId=None, x__xgafv=None)
+ Deletes a single Authorization.
+
+Args:
+ name: string, Required. The name of the Authorization to delete. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}/authorizations/{authorization} (required)
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
+}
+get(name, x__xgafv=None)
+ Gets details of a single Authorization.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing Authorization object
+ "clientUserId": "A String", # Output only. The client_user_id provided by the client application for their end user. Not verified by Google.
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "name": "A String", # Identifier. name of resource
+ "scopes": [ # Output only. The scopes actually granted by the end user during the consent flow.
+ "A String",
+ ],
+ "state": "A String", # Output only. The state of the authorization.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists Authorizations in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ filter: string, Optional. Filter string to restrict the results. Currently supports filtering by `client_user_id` only. Format: `client_user_id=""`
+ orderBy: string, Optional. This field is currently ignored. Defaults to ordering by authorization_id in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A page token, received from a previous `ListAuthorizations` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListAuthorizations` must match the call that provided the page token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing Authorizations
+ "authorizations": [ # The list of Authorization
+ { # Message describing Authorization object
+ "clientUserId": "A String", # Output only. The client_user_id provided by the client application for their end user. Not verified by Google.
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "name": "A String", # Identifier. name of resource
+ "scopes": [ # Output only. The scopes actually granted by the end user during the consent flow.
+ "A String",
+ ],
+ "state": "A String", # Output only. The state of the authorization.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ authorizations()
+
Returns the authorizations Resource.
+ +
+ close()
Close httplib2 connections.
+
+ create(parent, authProviderId=None, body=None, requestId=None, x__xgafv=None)
Creates a new AuthProvider in a given project and location.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a single AuthProvider.
+
+ disable(name, body=None, x__xgafv=None)
Disables a single AuthProvider.
+
+ enable(name, body=None, x__xgafv=None)
Enables a single AuthProvider.
+ +Gets details of a single AuthProvider.
+
+ getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+ +Lists AuthProviders in a given project and location.
+ +Retrieves the next page of results.
+
+ patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
Updates the parameters of a single AuthProvider.
+
+ query(parent, pageSize=None, pageToken=None, workloadId=None, x__xgafv=None)
Queries what all auth_providers are used by a given workload_id.
+
+ queryWorkloads(name, pageSize=None, pageToken=None, x__xgafv=None)
Queries what all workloads are using a given auth_provider.
+ +Retrieves the next page of results.
+ +Retrieves the next page of results.
+
+ revokeAuthorization(name, body=None, x__xgafv=None)
Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
+
+ setIamPolicy(resource, body=None, x__xgafv=None)
Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+ testIamPermissions(resource, body=None, x__xgafv=None)
Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.
+
+ undelete(name, body=None, x__xgafv=None)
Undeletes a single AuthProvider.
+close()
+ Close httplib2 connections.+
create(parent, authProviderId=None, body=None, requestId=None, x__xgafv=None)
+ Creates a new AuthProvider in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the AuthProvider is created. Format: projects/{project}/locations/{location} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+
+ authProviderId: string, Required. The ID to use for the AuthProvider, which will become the final segment of the AuthProvider's resource name. This value should be 1-63 characters, and valid characters are /a-z-/. The first character must be a lowercase letter, and the last character must be a lowercase letter or a number.
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+delete(name, requestId=None, x__xgafv=None)
+ Deletes a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
+}
+disable(name, body=None, x__xgafv=None)
+ Disables a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for disabling an AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+enable(name, body=None, x__xgafv=None)
+ Enables a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for enabling an AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+get(name, x__xgafv=None)
+ Gets details of a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)
+ Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ options_requestedPolicyVersion: integer, Optional. The maximum policy version that will be used to format the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional role bindings must specify version 3. Policies with no conditional role bindings may specify any valid value or leave the field unset. The policy in the response might use the policy version that you specified, or it might use a lower policy version. For example, if you specify version 3, but the policy has no conditional role bindings, the response uses version 1. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, showDeleted=None, x__xgafv=None)
+ Lists AuthProviders in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ filter: string, Optional. Filter results. This field is currently ignored.
+ orderBy: string, Optional. Currently ignored. Defaults to ordering by auth_provider_id in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, the first page is returned.
+ showDeleted: boolean, Optional. Deleted auth_providers will be kept with a soft-delete for 30 days before being purged. If this field is set to true, deleted auth_providers will also be returned.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing AuthProviders
+ "authProviders": [ # The list of AuthProvider
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
+ Updates the parameters of a single AuthProvider.
+
+Args:
+ name: string, Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ updateMask: string, Optional. Field mask is used to specify the fields to be overwritten in the AuthProvider resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields present in the request will be overwritten.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+query(parent, pageSize=None, pageToken=None, workloadId=None, x__xgafv=None)
+ Queries what all auth_providers are used by a given workload_id.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. The maximum page size is 1000.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, the first page is returned. A page token, received from a previous QueryAuthProviders call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to QueryAuthProviders must match the call that provided the page token.
+ workloadId: string, Required. The workload identifier to filter by.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for QueryAuthProviders.
+ "authProviderNames": [ # The unique list of auth_provider resource names used by the workload.
+ "A String",
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return. If this field is omitted, there are no subsequent pages.
+}
+queryWorkloads(name, pageSize=None, pageToken=None, x__xgafv=None)
+ Queries what all workloads are using a given auth_provider.
+
+Args:
+ name: string, Required. The name of the auth_provider to query. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. When paginating, all other parameters provided to QueryWorkloads must match the call that provided the page token. If this field is omitted, the first page is returned.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for QueryWorkloads.
+ "nextPageToken": "A String", # A token to retrieve the next page of results.
+ "workloadIds": [ # The unique list of workload identifiers (agents) that used the auth_provider.
+ "A String",
+ ],
+}
+queryWorkloads_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
query_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
revokeAuthorization(name, body=None, x__xgafv=None)
+ Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
+
+Args:
+ name: string, Required. The resource name of the AuthProvider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for RevokeAuthorization.
+ "userId": "A String", # Required. The identity of the user to revoke authorization for.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for RevokeAuthorization.
+}
+setIamPolicy(resource, body=None, x__xgafv=None)
+ Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy is being specified. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+ "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Google Cloud services (such as Projects) might reject them.
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ },
+ "updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: "bindings, etag"`
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}
+testIamPermissions(resource, body=None, x__xgafv=None)
+ Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy detail is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+ "permissions": [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as `*` or `storage.*`) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+ "A String",
+ ],
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for `TestIamPermissions` method.
+ "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+ "A String",
+ ],
+}
+undelete(name, body=None, x__xgafv=None)
+ Undeletes a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for undeleting a AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+Returns the accessSummaries Resource.
+ +
+ authProviders()
+
Returns the authProviders Resource.
+ +
+ close()
Close httplib2 connections.
+ +Gets information about a location.
+
+ list(name, extraLocationTypes=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists information about the supported locations for this service. This method lists locations based on the resource scope provided in the ListLocationsRequest.name field: * **Global locations**: If `name` is empty, the method lists the public locations available to all projects. * **Project-specific locations**: If `name` follows the format `projects/{project}`, the method lists locations visible to that specific project. This includes public, private, or other project-specific locations enabled for the project. For gRPC and client library implementations, the resource name is passed as the `name` field. For direct service calls, the resource name is incorporated into the request path based on the specific service implementation and version.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Gets information about a location.
+
+Args:
+ name: string, Resource name for the location. (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A resource that represents a Google Cloud location.
+ "displayName": "A String", # The friendly name for this location, typically a nearby city name. For example, "Tokyo".
+ "labels": { # Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
+ "a_key": "A String",
+ },
+ "locationId": "A String", # The canonical id for this location. For example: `"us-east1"`.
+ "metadata": { # Service-specific metadata. For example the available capacity at the given location.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # Resource name for the location, which may vary between implementations. For example: `"projects/example-project/locations/us-east1"`
+}
+list(name, extraLocationTypes=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists information about the supported locations for this service. This method lists locations based on the resource scope provided in the ListLocationsRequest.name field: * **Global locations**: If `name` is empty, the method lists the public locations available to all projects. * **Project-specific locations**: If `name` follows the format `projects/{project}`, the method lists locations visible to that specific project. This includes public, private, or other project-specific locations enabled for the project. For gRPC and client library implementations, the resource name is passed as the `name` field. For direct service calls, the resource name is incorporated into the request path based on the specific service implementation and version.
+
+Args:
+ name: string, The resource that owns the locations collection, if applicable. (required)
+ extraLocationTypes: string, Optional. Do not use this field unless explicitly documented otherwise. This is primarily for internal usage. (repeated)
+ filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like `"displayName=tokyo"`, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+ pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+ pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # The response message for Locations.ListLocations.
+ "locations": [ # A list of locations that matches the specified filter in the request.
+ { # A resource that represents a Google Cloud location.
+ "displayName": "A String", # The friendly name for this location, typically a nearby city name. For example, "Tokyo".
+ "labels": { # Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
+ "a_key": "A String",
+ },
+ "locationId": "A String", # The canonical id for this location. For example: `"us-east1"`.
+ "metadata": { # Service-specific metadata. For example the available capacity at the given location.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # Resource name for the location, which may vary between implementations. For example: `"projects/example-project/locations/us-east1"`
+ },
+ ],
+ "nextPageToken": "A String", # The standard List next-page token.
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ projects()
+
Returns the projects Resource.
+ +
+ close()
Close httplib2 connections.
+ +Create a BatchHttpRequest object based on the discovery document.
+close()
+ Close httplib2 connections.+
new_batch_http_request()
+ Create a BatchHttpRequest object based on the discovery document. + + Args: + callback: callable, A callback to be called for each response, of the + form callback(id, response, exception). The first parameter is the + request id, and the second is the deserialized response object. The + third is an apiclient.errors.HttpError exception object if an HTTP + error occurred while processing the request, or None if no error + occurred. + + Returns: + A BatchHttpRequest object based on the discovery document. ++
+ locations()
+
Returns the locations Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ close()
Close httplib2 connections.
+ +Gets details of a single AccessSummary.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists AccessSummaries in a given project and location. Supported Filters: - `workload_id`: Filter by the SPIFFE ID of the agent. Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Gets details of a single AccessSummary.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AccessSummary object
+ "authProvider": "A String", # Output only. The auth_provider that this access summary is associated with.
+ "authProviderType": "A String", # Output only. The type of the connector that was used to create this access summary.
+ "firstAccessTime": "A String", # Output only. The first time this user has interacted with this workload. Rounded to the previous hour.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "lastAccessTime": "A String", # Output only. The most recent time this user has interacted with this workload. Rounded to the previous hour.
+ "name": "A String", # Output only. Identifier. Name of the AccessSummary
+ "purgeTime": "A String", # Output only. The time when this access summary is permanently deleted.
+ "scopes": [ # Output only. All scopes that have been used by this user with this workload. The number of scopes is limited to 200.
+ "A String",
+ ],
+ "tokenUrl": "A String", # Output only. The url of the authentication server that was accessed.
+ "userId": "A String", # Output only. The user_id provided by the workload application for this user. Not verified by Google.
+ "workloadId": "A String", # Output only. The identity bound to the workload that this user interacted with to produce this AccessSummary. Will typically be an agentic spiffe id
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists AccessSummaries in a given project and location. Supported Filters: - `workload_id`: Filter by the SPIFFE ID of the agent. Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ filter: string, Optional. Filter string to restrict the results. Currently supports filtering by `workload_id` or `auth_provider_name`. If no filter is provided, returns all access summaries for the requested project and location. Format: `workload_id=""` or `auth_provider_name=""`
+ orderBy: string, Optional. This field is currently ignored. Defaults to ordering by (auth_provider_id, user_id) in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token identifying a page of results the server should return.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing AccessSummaries
+ "accessSummaries": [ # The list of AccessSummary
+ { # Message describing AccessSummary object
+ "authProvider": "A String", # Output only. The auth_provider that this access summary is associated with.
+ "authProviderType": "A String", # Output only. The type of the connector that was used to create this access summary.
+ "firstAccessTime": "A String", # Output only. The first time this user has interacted with this workload. Rounded to the previous hour.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "lastAccessTime": "A String", # Output only. The most recent time this user has interacted with this workload. Rounded to the previous hour.
+ "name": "A String", # Output only. Identifier. Name of the AccessSummary
+ "purgeTime": "A String", # Output only. The time when this access summary is permanently deleted.
+ "scopes": [ # Output only. All scopes that have been used by this user with this workload. The number of scopes is limited to 200.
+ "A String",
+ ],
+ "tokenUrl": "A String", # Output only. The url of the authentication server that was accessed.
+ "userId": "A String", # Output only. The user_id provided by the workload application for this user. Not verified by Google.
+ "workloadId": "A String", # Output only. The identity bound to the workload that this user interacted with to produce this AccessSummary. Will typically be an agentic spiffe id
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ close()
Close httplib2 connections.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a single Authorization.
+ +Gets details of a single Authorization.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists Authorizations in a given project and location.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
delete(name, requestId=None, x__xgafv=None)
+ Deletes a single Authorization.
+
+Args:
+ name: string, Required. The name of the Authorization to delete. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}/authorizations/{authorization} (required)
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
+}
+get(name, x__xgafv=None)
+ Gets details of a single Authorization.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing Authorization object
+ "clientUserId": "A String", # Output only. The client_user_id provided by the client application for their end user. Not verified by Google.
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "name": "A String", # Identifier. name of resource
+ "scopes": [ # Output only. The scopes actually granted by the end user during the consent flow.
+ "A String",
+ ],
+ "state": "A String", # Output only. The state of the authorization.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists Authorizations in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ filter: string, Optional. Filter string to restrict the results. Currently supports filtering by `client_user_id` only. Format: `client_user_id=""`
+ orderBy: string, Optional. This field is currently ignored. Defaults to ordering by authorization_id in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A page token, received from a previous `ListAuthorizations` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListAuthorizations` must match the call that provided the page token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing Authorizations
+ "authorizations": [ # The list of Authorization
+ { # Message describing Authorization object
+ "clientUserId": "A String", # Output only. The client_user_id provided by the client application for their end user. Not verified by Google.
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "name": "A String", # Identifier. name of resource
+ "scopes": [ # Output only. The scopes actually granted by the end user during the consent flow.
+ "A String",
+ ],
+ "state": "A String", # Output only. The state of the authorization.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ authorizations()
+
Returns the authorizations Resource.
+ +
+ close()
Close httplib2 connections.
+
+ create(parent, authProviderId=None, body=None, requestId=None, x__xgafv=None)
Creates a new AuthProvider in a given project and location.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a single AuthProvider.
+
+ disable(name, body=None, x__xgafv=None)
Disables a single AuthProvider.
+
+ enable(name, body=None, x__xgafv=None)
Enables a single AuthProvider.
+ +Gets details of a single AuthProvider.
+
+ getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+ +Lists AuthProviders in a given project and location.
+ +Retrieves the next page of results.
+
+ patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
Updates the parameters of a single AuthProvider.
+
+ query(parent, pageSize=None, pageToken=None, workloadId=None, x__xgafv=None)
Queries what all auth_providers are used by a given workload_id.
+
+ queryWorkloads(name, pageSize=None, pageToken=None, x__xgafv=None)
Queries what all workloads are using a given auth_provider.
+ +Retrieves the next page of results.
+ +Retrieves the next page of results.
+
+ revokeAuthorization(name, body=None, x__xgafv=None)
Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
+
+ setIamPolicy(resource, body=None, x__xgafv=None)
Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+ testIamPermissions(resource, body=None, x__xgafv=None)
Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.
+
+ undelete(name, body=None, x__xgafv=None)
Undeletes a single AuthProvider.
+close()
+ Close httplib2 connections.+
create(parent, authProviderId=None, body=None, requestId=None, x__xgafv=None)
+ Creates a new AuthProvider in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the AuthProvider is created. Format: projects/{project}/locations/{location} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+
+ authProviderId: string, Required. The ID to use for the AuthProvider, which will become the final segment of the AuthProvider's resource name. This value should be 1-63 characters, and valid characters are /a-z-/. The first character must be a lowercase letter, and the last character must be a lowercase letter or a number.
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+delete(name, requestId=None, x__xgafv=None)
+ Deletes a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
+}
+disable(name, body=None, x__xgafv=None)
+ Disables a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for disabling an AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+enable(name, body=None, x__xgafv=None)
+ Enables a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for enabling an AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+get(name, x__xgafv=None)
+ Gets details of a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)
+ Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ options_requestedPolicyVersion: integer, Optional. The maximum policy version that will be used to format the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional role bindings must specify version 3. Policies with no conditional role bindings may specify any valid value or leave the field unset. The policy in the response might use the policy version that you specified, or it might use a lower policy version. For example, if you specify version 3, but the policy has no conditional role bindings, the response uses version 1. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, showDeleted=None, x__xgafv=None)
+ Lists AuthProviders in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ filter: string, Optional. Filter results. This field is currently ignored.
+ orderBy: string, Optional. Currently ignored. Defaults to ordering by auth_provider_id in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, the first page is returned.
+ showDeleted: boolean, Optional. Deleted auth_providers will be kept with a soft-delete for 30 days before being purged. If this field is set to true, deleted auth_providers will also be returned.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing AuthProviders
+ "authProviders": [ # The list of AuthProvider
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
+ Updates the parameters of a single AuthProvider.
+
+Args:
+ name: string, Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ updateMask: string, Optional. Field mask is used to specify the fields to be overwritten in the AuthProvider resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields present in the request will be overwritten.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+query(parent, pageSize=None, pageToken=None, workloadId=None, x__xgafv=None)
+ Queries what all auth_providers are used by a given workload_id.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. The maximum page size is 1000.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, the first page is returned. A page token, received from a previous QueryAuthProviders call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to QueryAuthProviders must match the call that provided the page token.
+ workloadId: string, Required. The workload identifier to filter by.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for QueryAuthProviders.
+ "authProviderNames": [ # The unique list of auth_provider resource names used by the workload.
+ "A String",
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return. If this field is omitted, there are no subsequent pages.
+}
+queryWorkloads(name, pageSize=None, pageToken=None, x__xgafv=None)
+ Queries what all workloads are using a given auth_provider.
+
+Args:
+ name: string, Required. The name of the auth_provider to query. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. When paginating, all other parameters provided to QueryWorkloads must match the call that provided the page token. If this field is omitted, the first page is returned.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for QueryWorkloads.
+ "nextPageToken": "A String", # A token to retrieve the next page of results.
+ "workloadIds": [ # The unique list of workload identifiers (agents) that used the auth_provider.
+ "A String",
+ ],
+}
+queryWorkloads_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
query_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
revokeAuthorization(name, body=None, x__xgafv=None)
+ Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
+
+Args:
+ name: string, Required. The resource name of the AuthProvider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for RevokeAuthorization.
+ "userId": "A String", # Required. The identity of the user to revoke authorization for.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for RevokeAuthorization.
+}
+setIamPolicy(resource, body=None, x__xgafv=None)
+ Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy is being specified. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+ "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Google Cloud services (such as Projects) might reject them.
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ },
+ "updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: "bindings, etag"`
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}
+testIamPermissions(resource, body=None, x__xgafv=None)
+ Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy detail is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+ "permissions": [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as `*` or `storage.*`) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+ "A String",
+ ],
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for `TestIamPermissions` method.
+ "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+ "A String",
+ ],
+}
+undelete(name, body=None, x__xgafv=None)
+ Undeletes a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for undeleting a AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+Returns the accessSummaries Resource.
+ +
+ authProviders()
+
Returns the authProviders Resource.
+ +
+ close()
Close httplib2 connections.
+ +Gets information about a location.
+
+ list(name, extraLocationTypes=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists information about the supported locations for this service. This method lists locations based on the resource scope provided in the ListLocationsRequest.name field: * **Global locations**: If `name` is empty, the method lists the public locations available to all projects. * **Project-specific locations**: If `name` follows the format `projects/{project}`, the method lists locations visible to that specific project. This includes public, private, or other project-specific locations enabled for the project. For gRPC and client library implementations, the resource name is passed as the `name` field. For direct service calls, the resource name is incorporated into the request path based on the specific service implementation and version.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Gets information about a location.
+
+Args:
+ name: string, Resource name for the location. (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A resource that represents a Google Cloud location.
+ "displayName": "A String", # The friendly name for this location, typically a nearby city name. For example, "Tokyo".
+ "labels": { # Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
+ "a_key": "A String",
+ },
+ "locationId": "A String", # The canonical id for this location. For example: `"us-east1"`.
+ "metadata": { # Service-specific metadata. For example the available capacity at the given location.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # Resource name for the location, which may vary between implementations. For example: `"projects/example-project/locations/us-east1"`
+}
+list(name, extraLocationTypes=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists information about the supported locations for this service. This method lists locations based on the resource scope provided in the ListLocationsRequest.name field: * **Global locations**: If `name` is empty, the method lists the public locations available to all projects. * **Project-specific locations**: If `name` follows the format `projects/{project}`, the method lists locations visible to that specific project. This includes public, private, or other project-specific locations enabled for the project. For gRPC and client library implementations, the resource name is passed as the `name` field. For direct service calls, the resource name is incorporated into the request path based on the specific service implementation and version.
+
+Args:
+ name: string, The resource that owns the locations collection, if applicable. (required)
+ extraLocationTypes: string, Optional. Do not use this field unless explicitly documented otherwise. This is primarily for internal usage. (repeated)
+ filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like `"displayName=tokyo"`, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+ pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+ pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # The response message for Locations.ListLocations.
+ "locations": [ # A list of locations that matches the specified filter in the request.
+ { # A resource that represents a Google Cloud location.
+ "displayName": "A String", # The friendly name for this location, typically a nearby city name. For example, "Tokyo".
+ "labels": { # Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
+ "a_key": "A String",
+ },
+ "locationId": "A String", # The canonical id for this location. For example: `"us-east1"`.
+ "metadata": { # Service-specific metadata. For example the available capacity at the given location.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # Resource name for the location, which may vary between implementations. For example: `"projects/example-project/locations/us-east1"`
+ },
+ ],
+ "nextPageToken": "A String", # The standard List next-page token.
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ projects()
+
Returns the projects Resource.
+ +
+ close()
Close httplib2 connections.
+ +Create a BatchHttpRequest object based on the discovery document.
+close()
+ Close httplib2 connections.+
new_batch_http_request()
+ Create a BatchHttpRequest object based on the discovery document. + + Args: + callback: callable, A callback to be called for each response, of the + form callback(id, response, exception). The first parameter is the + request id, and the second is the deserialized response object. The + third is an apiclient.errors.HttpError exception object if an HTTP + error occurred while processing the request, or None if no error + occurred. + + Returns: + A BatchHttpRequest object based on the discovery document. ++
+ locations()
+
Returns the locations Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ close()
Close httplib2 connections.
+ +Gets details of a single AccessSummary.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists AccessSummaries in a given project and location. Supported Filters: - `workload_id`: Filter by the SPIFFE ID of the agent. Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Gets details of a single AccessSummary.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AccessSummary object
+ "authProvider": "A String", # Output only. The auth_provider that this access summary is associated with.
+ "authProviderType": "A String", # Output only. The type of the connector that was used to create this access summary.
+ "firstAccessTime": "A String", # Output only. The first time this user has interacted with this workload. Rounded to the previous hour.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "lastAccessTime": "A String", # Output only. The most recent time this user has interacted with this workload. Rounded to the previous hour.
+ "name": "A String", # Output only. Identifier. Name of the AccessSummary
+ "purgeTime": "A String", # Output only. The time when this access summary is permanently deleted.
+ "scopes": [ # Output only. All scopes that have been used by this user with this workload. The number of scopes is limited to 200.
+ "A String",
+ ],
+ "tokenUrl": "A String", # Output only. The url of the authentication server that was accessed.
+ "userId": "A String", # Output only. The user_id provided by the workload application for this user. Not verified by Google.
+ "workloadId": "A String", # Output only. The identity bound to the workload that this user interacted with to produce this AccessSummary. Will typically be an agentic spiffe id
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists AccessSummaries in a given project and location. Supported Filters: - `workload_id`: Filter by the SPIFFE ID of the agent. Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ filter: string, Optional. Filter string to restrict the results. Currently supports filtering by `workload_id` or `auth_provider_name`. If no filter is provided, returns all access summaries for the requested project and location. Format: `workload_id=""` or `auth_provider_name=""`
+ orderBy: string, Optional. This field is currently ignored. Defaults to ordering by (auth_provider_id, user_id) in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token identifying a page of results the server should return.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing AccessSummaries
+ "accessSummaries": [ # The list of AccessSummary
+ { # Message describing AccessSummary object
+ "authProvider": "A String", # Output only. The auth_provider that this access summary is associated with.
+ "authProviderType": "A String", # Output only. The type of the connector that was used to create this access summary.
+ "firstAccessTime": "A String", # Output only. The first time this user has interacted with this workload. Rounded to the previous hour.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "lastAccessTime": "A String", # Output only. The most recent time this user has interacted with this workload. Rounded to the previous hour.
+ "name": "A String", # Output only. Identifier. Name of the AccessSummary
+ "purgeTime": "A String", # Output only. The time when this access summary is permanently deleted.
+ "scopes": [ # Output only. All scopes that have been used by this user with this workload. The number of scopes is limited to 200.
+ "A String",
+ ],
+ "tokenUrl": "A String", # Output only. The url of the authentication server that was accessed.
+ "userId": "A String", # Output only. The user_id provided by the workload application for this user. Not verified by Google.
+ "workloadId": "A String", # Output only. The identity bound to the workload that this user interacted with to produce this AccessSummary. Will typically be an agentic spiffe id
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ close()
Close httplib2 connections.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a single Authorization.
+ +Gets details of a single Authorization.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists Authorizations in a given project and location.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
delete(name, requestId=None, x__xgafv=None)
+ Deletes a single Authorization.
+
+Args:
+ name: string, Required. The name of the Authorization to delete. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}/authorizations/{authorization} (required)
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
+}
+get(name, x__xgafv=None)
+ Gets details of a single Authorization.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing Authorization object
+ "clientUserId": "A String", # Output only. The client_user_id provided by the client application for their end user. Not verified by Google.
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "name": "A String", # Identifier. name of resource
+ "scopes": [ # Output only. The scopes actually granted by the end user during the consent flow.
+ "A String",
+ ],
+ "state": "A String", # Output only. The state of the authorization.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists Authorizations in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ filter: string, Optional. Filter string to restrict the results. Currently supports filtering by `client_user_id` only. Format: `client_user_id=""`
+ orderBy: string, Optional. This field is currently ignored. Defaults to ordering by authorization_id in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A page token, received from a previous `ListAuthorizations` call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to `ListAuthorizations` must match the call that provided the page token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing Authorizations
+ "authorizations": [ # The list of Authorization
+ { # Message describing Authorization object
+ "clientUserId": "A String", # Output only. The client_user_id provided by the client application for their end user. Not verified by Google.
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "name": "A String", # Identifier. name of resource
+ "scopes": [ # Output only. The scopes actually granted by the end user during the consent flow.
+ "A String",
+ ],
+ "state": "A String", # Output only. The state of the authorization.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ authorizations()
+
Returns the authorizations Resource.
+ +
+ close()
Close httplib2 connections.
+
+ create(parent, authProviderId=None, body=None, requestId=None, x__xgafv=None)
Creates a new AuthProvider in a given project and location.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a single AuthProvider.
+
+ disable(name, body=None, x__xgafv=None)
Disables a single AuthProvider.
+
+ enable(name, body=None, x__xgafv=None)
Enables a single AuthProvider.
+ +Gets details of a single AuthProvider.
+
+ getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+ +Lists AuthProviders in a given project and location.
+ +Retrieves the next page of results.
+
+ patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
Updates the parameters of a single AuthProvider.
+
+ query(parent, pageSize=None, pageToken=None, workloadId=None, x__xgafv=None)
Queries what all auth_providers are used by a given workload_id.
+
+ queryWorkloads(name, pageSize=None, pageToken=None, x__xgafv=None)
Queries what all workloads are using a given auth_provider.
+ +Retrieves the next page of results.
+ +Retrieves the next page of results.
+
+ revokeAuthorization(name, body=None, x__xgafv=None)
Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
+
+ setIamPolicy(resource, body=None, x__xgafv=None)
Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+ testIamPermissions(resource, body=None, x__xgafv=None)
Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.
+
+ undelete(name, body=None, x__xgafv=None)
Undeletes a single AuthProvider.
+close()
+ Close httplib2 connections.+
create(parent, authProviderId=None, body=None, requestId=None, x__xgafv=None)
+ Creates a new AuthProvider in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the AuthProvider is created. Format: projects/{project}/locations/{location} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+
+ authProviderId: string, Required. The ID to use for the AuthProvider, which will become the final segment of the AuthProvider's resource name. This value should be 1-63 characters, and valid characters are /a-z-/. The first character must be a lowercase letter, and the last character must be a lowercase letter or a number.
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+delete(name, requestId=None, x__xgafv=None)
+ Deletes a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
+}
+disable(name, body=None, x__xgafv=None)
+ Disables a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for disabling an AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+enable(name, body=None, x__xgafv=None)
+ Enables a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for enabling an AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+get(name, x__xgafv=None)
+ Gets details of a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)
+ Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ options_requestedPolicyVersion: integer, Optional. The maximum policy version that will be used to format the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional role bindings must specify version 3. Policies with no conditional role bindings may specify any valid value or leave the field unset. The policy in the response might use the policy version that you specified, or it might use a lower policy version. For example, if you specify version 3, but the policy has no conditional role bindings, the response uses version 1. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, showDeleted=None, x__xgafv=None)
+ Lists AuthProviders in a given project and location.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ filter: string, Optional. Filter results. This field is currently ignored.
+ orderBy: string, Optional. Currently ignored. Defaults to ordering by auth_provider_id in ascending order.
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, the first page is returned.
+ showDeleted: boolean, Optional. Deleted auth_providers will be kept with a soft-delete for 30 days before being purged. If this field is set to true, deleted auth_providers will also be returned.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message for response to listing AuthProviders
+ "authProviders": [ # The list of AuthProvider
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+ },
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return.
+ "unreachable": [ # Unordered list. Locations that could not be reached.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
+ Updates the parameters of a single AuthProvider.
+
+Args:
+ name: string, Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+
+ requestId: string, Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+ updateMask: string, Optional. Field mask is used to specify the fields to be overwritten in the AuthProvider resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields present in the request will be overwritten.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+query(parent, pageSize=None, pageToken=None, workloadId=None, x__xgafv=None)
+ Queries what all auth_providers are used by a given workload_id.
+
+Args:
+ parent: string, Required. The parent resource where the search is performed. Format: projects/{project}/locations/{location} (required)
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. The maximum page size is 1000.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, the first page is returned. A page token, received from a previous QueryAuthProviders call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to QueryAuthProviders must match the call that provided the page token.
+ workloadId: string, Required. The workload identifier to filter by.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for QueryAuthProviders.
+ "authProviderNames": [ # The unique list of auth_provider resource names used by the workload.
+ "A String",
+ ],
+ "nextPageToken": "A String", # A token identifying a page of results the server should return. If this field is omitted, there are no subsequent pages.
+}
+queryWorkloads(name, pageSize=None, pageToken=None, x__xgafv=None)
+ Queries what all workloads are using a given auth_provider.
+
+Args:
+ name: string, Required. The name of the auth_provider to query. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token, which can be sent as `page_token` to retrieve the next page. When paginating, all other parameters provided to QueryWorkloads must match the call that provided the page token. If this field is omitted, the first page is returned.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for QueryWorkloads.
+ "nextPageToken": "A String", # A token to retrieve the next page of results.
+ "workloadIds": [ # The unique list of workload identifiers (agents) that used the auth_provider.
+ "A String",
+ ],
+}
+queryWorkloads_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
query_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
revokeAuthorization(name, body=None, x__xgafv=None)
+ Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
+
+Args:
+ name: string, Required. The resource name of the AuthProvider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for RevokeAuthorization.
+ "userId": "A String", # Required. The identity of the user to revoke authorization for.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for RevokeAuthorization.
+}
+setIamPolicy(resource, body=None, x__xgafv=None)
+ Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy is being specified. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+ "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Google Cloud services (such as Projects) might reject them.
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ },
+ "updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: "bindings, etag"`
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** ``` { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}
+testIamPermissions(resource, body=None, x__xgafv=None)
+ Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.
+
+Args:
+ resource: string, REQUIRED: The resource for which the policy detail is being requested. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+ "permissions": [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as `*` or `storage.*`) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+ "A String",
+ ],
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for `TestIamPermissions` method.
+ "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+ "A String",
+ ],
+}
+undelete(name, body=None, x__xgafv=None)
+ Undeletes a single AuthProvider.
+
+Args:
+ name: string, Required. Name of the resource Format: projects/{project}/locations/{location}/authProviders/{auth_provider} (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Message for undeleting a AuthProvider
+ "requestId": "A String", # Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Message describing AuthProvider object
+ "allowedScopes": [ # Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
+ "A String",
+ ],
+ "authProviderTypeParams": { # AuthProvider type specific parameters. Required when creating an auth_provider. # Required. AuthProvider type specific parameters.
+ "apiKey": { # Message describing ApiKeyParams object. # ApiKey AuthProvider type parameters.
+ "apiKey": "A String", # Optional. Input only. The API key for this auth_provider.
+ },
+ "geAuthProvider": { # Message describing GeminiEnterpriseAuthProviderParams object. # GeminiEnterprise auth_provider type parameters.
+ },
+ "threeLeggedOauth": { # Message describing ThreeLeggedOAuth object. # ThreeLeggedOAuth AuthProvider type parameters.
+ "authorizationUrl": "A String", # Optional. The authorization endpoint to send users to for consenting to delegate to the agent. eg. "https://auth.atlassian.com/authorize"
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "defaultContinueUri": "A String", # Optional. The default continue URI for 3LO flow and it will be used when no continue URI is provided in the RetrieveCredentials request.
+ "enablePkce": True or False, # Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to prevent authorization code interception attacks.
+ "redirectUrl": "A String", # Output only. The redirect URL this auth_provider uses for the OAuth exchange. This is deterministic based on the name of the auth_provider.
+ "tokenUrl": "A String", # Optional. The token endpoint for requesting tokens on behalf of an end user. eg. "https://auth.atlassian.com/oauth/token"
+ },
+ "twoLeggedOauth": { # Message describing TwoLeggedOAuth object. # TwoLeggedOAuth AuthProvider type parameters.
+ "clientId": "A String", # Optional. The client ID of the OAuth client.
+ "clientSecret": "A String", # Optional. Input only. The client secret of the OAuth client.
+ "tokenUrl": "A String", # Optional. The token endpoint of the OAuth client.
+ },
+ },
+ "blockedScopes": [ # Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
+ "A String",
+ ],
+ "createTime": "A String", # Output only. [Output only] Create time stamp
+ "deleted": True or False, # Output only. This is set to true if the auth_provider is deleted.
+ "description": "A String", # Optional. Description of the resource. Must be less than 256 characters.
+ "expireTime": "A String", # Output only. The time when the auth_provider will expire.
+ "labels": { # Optional. Labels as key value pairs
+ "a_key": "A String",
+ },
+ "name": "A String", # Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
+ "state": "A String", # Output only. The state of the auth_provider.
+ "updateTime": "A String", # Output only. [Output only] Update time stamp
+ "workloadIds": [ # Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
+ "A String",
+ ],
+}
+Returns the accessSummaries Resource.
+ +
+ authProviders()
+
Returns the authProviders Resource.
+ +
+ close()
Close httplib2 connections.
+ +Gets information about a location.
+
+ list(name, extraLocationTypes=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists information about the supported locations for this service. This method lists locations based on the resource scope provided in the ListLocationsRequest.name field: * **Global locations**: If `name` is empty, the method lists the public locations available to all projects. * **Project-specific locations**: If `name` follows the format `projects/{project}`, the method lists locations visible to that specific project. This includes public, private, or other project-specific locations enabled for the project. For gRPC and client library implementations, the resource name is passed as the `name` field. For direct service calls, the resource name is incorporated into the request path based on the specific service implementation and version.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Gets information about a location.
+
+Args:
+ name: string, Resource name for the location. (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # A resource that represents a Google Cloud location.
+ "displayName": "A String", # The friendly name for this location, typically a nearby city name. For example, "Tokyo".
+ "labels": { # Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
+ "a_key": "A String",
+ },
+ "locationId": "A String", # The canonical id for this location. For example: `"us-east1"`.
+ "metadata": { # Service-specific metadata. For example the available capacity at the given location.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # Resource name for the location, which may vary between implementations. For example: `"projects/example-project/locations/us-east1"`
+}
+list(name, extraLocationTypes=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists information about the supported locations for this service. This method lists locations based on the resource scope provided in the ListLocationsRequest.name field: * **Global locations**: If `name` is empty, the method lists the public locations available to all projects. * **Project-specific locations**: If `name` follows the format `projects/{project}`, the method lists locations visible to that specific project. This includes public, private, or other project-specific locations enabled for the project. For gRPC and client library implementations, the resource name is passed as the `name` field. For direct service calls, the resource name is incorporated into the request path based on the specific service implementation and version.
+
+Args:
+ name: string, The resource that owns the locations collection, if applicable. (required)
+ extraLocationTypes: string, Optional. Do not use this field unless explicitly documented otherwise. This is primarily for internal usage. (repeated)
+ filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like `"displayName=tokyo"`, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+ pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+ pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # The response message for Locations.ListLocations.
+ "locations": [ # A list of locations that matches the specified filter in the request.
+ { # A resource that represents a Google Cloud location.
+ "displayName": "A String", # The friendly name for this location, typically a nearby city name. For example, "Tokyo".
+ "labels": { # Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
+ "a_key": "A String",
+ },
+ "locationId": "A String", # The canonical id for this location. For example: `"us-east1"`.
+ "metadata": { # Service-specific metadata. For example the available capacity at the given location.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # Resource name for the location, which may vary between implementations. For example: `"projects/example-project/locations/us-east1"`
+ },
+ ],
+ "nextPageToken": "A String", # The standard List next-page token.
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ projects()
+
Returns the projects Resource.
+ +
+ close()
Close httplib2 connections.
+ +Create a BatchHttpRequest object based on the discovery document.
+close()
+ Close httplib2 connections.+
new_batch_http_request()
+ Create a BatchHttpRequest object based on the discovery document. + + Args: + callback: callable, A callback to be called for each response, of the + form callback(id, response, exception). The first parameter is the + request id, and the second is the deserialized response object. The + third is an apiclient.errors.HttpError exception object if an HTTP + error occurred while processing the request, or None if no error + occurred. + + Returns: + A BatchHttpRequest object based on the discovery document. ++
+ locations()
+
Returns the locations Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ close()
Close httplib2 connections.
+
+ finalize(authProvider, body=None, x__xgafv=None)
Finalizes the credentials after a successful consent flow.
+
+ retrieve(authProvider, body=None, x__xgafv=None)
Retrieves authorization credentials for an authprovider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `status` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.
+close()
+ Close httplib2 connections.+
finalize(authProvider, body=None, x__xgafv=None)
+ Finalizes the credentials after a successful consent flow.
+
+Args:
+ authProvider: string, Required. The resource name of the AuthProvider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}` (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for FinalizeCredentials.
+ "consentNonce": "A String", # Required. The same consent_nonce value that was provided during redirect in the UriConsentRequired metadata.
+ "userId": "A String", # Required. The identity of the end user.
+ "userIdValidationState": "A String", # Required. The encrypted state passed back from the consent flow.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for FinalizeCredentials. Intentionally empty
+}
+retrieve(authProvider, body=None, x__xgafv=None)
+ Retrieves authorization credentials for an authprovider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `status` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.
+
+Args:
+ authProvider: string, Required. The parent resource name of the AuthProvider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}` (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for RetrieveCredentials.
+ "continueUri": "A String", # Optional. The URI to redirect the user to after consent is completed. This field is required for authproviders using the 3-legged OAuth flow. For other authprovider types, this field is unused but not rejected.
+ "forceRefreshToken": "A String", # Optional. Input only. Set this field only if the previous token was expired or invalid. This value must be the full, previously returned token string. Will trigger a refresh of the access token with a stored refresh token, if possible, or a new consent flow.
+ "scopes": [ # Optional. The OAuth scopes required for this access.
+ "A String",
+ ],
+ "userId": "A String", # Required. The identity of the end user.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for RetrieveCredentials. Contains the access tokens and related artifacts.
+ "consentRejected": { # Indicates the user has rejected the permission delegation or cancelled the request. # Message indicating consent was rejected.
+ },
+ "pending": { # Indicates that the credential retrieval is pending. The caller should retry the RetrieveCredentials request after some time. # Message indicating credential retrieval is pending.
+ },
+ "success": { # Message indicating successful retrieval of credentials. # Message indicating credentials were successfully retrieved.
+ "expireTime": "A String", # The expiration time of the token. This does not guarantee that the token will be valid until this time, since the token could be revoked earlier. There could also be clock skew between the auth provider and the client so it may expire slightly earlier. If not set, the token might be permanent or it may be that the service does not (or cannot) know when it will expire.
+ "header": "A String", # The HTTP header name where the token should be placed.
+ "scopes": [ # The scopes actually associated with the retrieved token. End users may have rejected some requested scopes, or the third-party authorization servers can return a different set of scopes than what was asked for. Callers should verify that all required scopes for their intended use are included in this list.
+ "A String",
+ ],
+ "token": "A String", # The retrieved access token or credential for the end user. On MCPTool call, for an invalid token OAuth spec says this should return 401 or 403, but MCPServers may implement this differently. If you get any flavor of `PERMISSION_DENIED`, retry your original request to RetrieveCredentials with force_refresh_token set to the expired/invalid token string, which will fetch a new token or initiate a new consent flow.
+ },
+ "uriConsentRequired": { # Indicates that the user must visit the provided URI to consent to delegate permission to the agent to act on their behalf. The caller can either poll the `RetrieveCredentials` method, or await the /ValidateUserId callback # Message indicating uri based consent is required.
+ "authorizationUri": "A String", # Output only. The URL where the user should be redirected to grant consent. This will always be present.
+ "consentNonce": "A String", # Output only. A one-time, randomly generated value that validates the entire consent flow is handled by a single user, avoiding CSRF attacks. It must be submitted with the FinalizeCredentials request to complete the OAuth exchange. This will always be present. Implemented per https://www.rfc-editor.org/rfc/rfc6819#section-5.3.5
+ "uid": "A String", # Output only. The unique ID of the credentials retrieval operation.
+ },
+}
+
+ credentials()
+
Returns the credentials Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ authProviders()
+
Returns the authProviders Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ projects()
+
Returns the projects Resource.
+ +
+ close()
Close httplib2 connections.
+ +Create a BatchHttpRequest object based on the discovery document.
+close()
+ Close httplib2 connections.+
new_batch_http_request()
+ Create a BatchHttpRequest object based on the discovery document. + + Args: + callback: callable, A callback to be called for each response, of the + form callback(id, response, exception). The first parameter is the + request id, and the second is the deserialized response object. The + third is an apiclient.errors.HttpError exception object if an HTTP + error occurred while processing the request, or None if no error + occurred. + + Returns: + A BatchHttpRequest object based on the discovery document. ++
+ locations()
+
Returns the locations Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ close()
Close httplib2 connections.
+
+ finalize(authProvider, body=None, x__xgafv=None)
Finalizes the credentials after a successful consent flow.
+
+ retrieve(authProvider, body=None, x__xgafv=None)
Retrieves authorization credentials for an authprovider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `status` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.
+close()
+ Close httplib2 connections.+
finalize(authProvider, body=None, x__xgafv=None)
+ Finalizes the credentials after a successful consent flow.
+
+Args:
+ authProvider: string, Required. The resource name of the AuthProvider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}` (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for FinalizeCredentials.
+ "consentNonce": "A String", # Required. The same consent_nonce value that was provided during redirect in the UriConsentRequired metadata.
+ "userId": "A String", # Required. The identity of the end user.
+ "userIdValidationState": "A String", # Required. The encrypted state passed back from the consent flow.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for FinalizeCredentials. Intentionally empty
+}
+retrieve(authProvider, body=None, x__xgafv=None)
+ Retrieves authorization credentials for an authprovider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `status` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.
+
+Args:
+ authProvider: string, Required. The parent resource name of the AuthProvider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}` (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for RetrieveCredentials.
+ "continueUri": "A String", # Optional. The URI to redirect the user to after consent is completed. This field is required for authproviders using the 3-legged OAuth flow. For other authprovider types, this field is unused but not rejected.
+ "forceRefreshToken": "A String", # Optional. Input only. Set this field only if the previous token was expired or invalid. This value must be the full, previously returned token string. Will trigger a refresh of the access token with a stored refresh token, if possible, or a new consent flow.
+ "scopes": [ # Optional. The OAuth scopes required for this access.
+ "A String",
+ ],
+ "userId": "A String", # Required. The identity of the end user.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for RetrieveCredentials. Contains the access tokens and related artifacts.
+ "consentRejected": { # Indicates the user has rejected the permission delegation or cancelled the request. # Message indicating consent was rejected.
+ },
+ "pending": { # Indicates that the credential retrieval is pending. The caller should retry the RetrieveCredentials request after some time. # Message indicating credential retrieval is pending.
+ },
+ "success": { # Message indicating successful retrieval of credentials. # Message indicating credentials were successfully retrieved.
+ "expireTime": "A String", # The expiration time of the token. This does not guarantee that the token will be valid until this time, since the token could be revoked earlier. There could also be clock skew between the auth provider and the client so it may expire slightly earlier. If not set, the token might be permanent or it may be that the service does not (or cannot) know when it will expire.
+ "header": "A String", # The HTTP header name where the token should be placed.
+ "scopes": [ # The scopes actually associated with the retrieved token. End users may have rejected some requested scopes, or the third-party authorization servers can return a different set of scopes than what was asked for. Callers should verify that all required scopes for their intended use are included in this list.
+ "A String",
+ ],
+ "token": "A String", # The retrieved access token or credential for the end user. On MCPTool call, for an invalid token OAuth spec says this should return 401 or 403, but MCPServers may implement this differently. If you get any flavor of `PERMISSION_DENIED`, retry your original request to RetrieveCredentials with force_refresh_token set to the expired/invalid token string, which will fetch a new token or initiate a new consent flow.
+ },
+ "uriConsentRequired": { # Indicates that the user must visit the provided URI to consent to delegate permission to the agent to act on their behalf. The caller can either poll the `RetrieveCredentials` method, or await the /ValidateUserId callback # Message indicating uri based consent is required.
+ "authorizationUri": "A String", # Output only. The URL where the user should be redirected to grant consent. This will always be present.
+ "consentNonce": "A String", # Output only. A one-time, randomly generated value that validates the entire consent flow is handled by a single user, avoiding CSRF attacks. It must be submitted with the FinalizeCredentials request to complete the OAuth exchange. This will always be present. Implemented per https://www.rfc-editor.org/rfc/rfc6819#section-5.3.5
+ "uid": "A String", # Output only. The unique ID of the credentials retrieval operation.
+ },
+}
+
+ credentials()
+
Returns the credentials Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ authProviders()
+
Returns the authProviders Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ projects()
+
Returns the projects Resource.
+ +
+ close()
Close httplib2 connections.
+ +Create a BatchHttpRequest object based on the discovery document.
+close()
+ Close httplib2 connections.+
new_batch_http_request()
+ Create a BatchHttpRequest object based on the discovery document. + + Args: + callback: callable, A callback to be called for each response, of the + form callback(id, response, exception). The first parameter is the + request id, and the second is the deserialized response object. The + third is an apiclient.errors.HttpError exception object if an HTTP + error occurred while processing the request, or None if no error + occurred. + + Returns: + A BatchHttpRequest object based on the discovery document. ++
+ locations()
+
Returns the locations Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ close()
Close httplib2 connections.
+
+ finalize(authProvider, body=None, x__xgafv=None)
Finalizes the credentials after a successful consent flow.
+
+ retrieve(authProvider, body=None, x__xgafv=None)
Retrieves authorization credentials for an authprovider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `status` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.
+close()
+ Close httplib2 connections.+
finalize(authProvider, body=None, x__xgafv=None)
+ Finalizes the credentials after a successful consent flow.
+
+Args:
+ authProvider: string, Required. The resource name of the AuthProvider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}` (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for FinalizeCredentials.
+ "consentNonce": "A String", # Required. The same consent_nonce value that was provided during redirect in the UriConsentRequired metadata.
+ "userId": "A String", # Required. The identity of the end user.
+ "userIdValidationState": "A String", # Required. The encrypted state passed back from the consent flow.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for FinalizeCredentials. Intentionally empty
+}
+retrieve(authProvider, body=None, x__xgafv=None)
+ Retrieves authorization credentials for an authprovider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `status` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.
+
+Args:
+ authProvider: string, Required. The parent resource name of the AuthProvider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}` (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Request message for RetrieveCredentials.
+ "continueUri": "A String", # Optional. The URI to redirect the user to after consent is completed. This field is required for authproviders using the 3-legged OAuth flow. For other authprovider types, this field is unused but not rejected.
+ "forceRefreshToken": "A String", # Optional. Input only. Set this field only if the previous token was expired or invalid. This value must be the full, previously returned token string. Will trigger a refresh of the access token with a stored refresh token, if possible, or a new consent flow.
+ "scopes": [ # Optional. The OAuth scopes required for this access.
+ "A String",
+ ],
+ "userId": "A String", # Required. The identity of the end user.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response message for RetrieveCredentials. Contains the access tokens and related artifacts.
+ "consentRejected": { # Indicates the user has rejected the permission delegation or cancelled the request. # Message indicating consent was rejected.
+ },
+ "pending": { # Indicates that the credential retrieval is pending. The caller should retry the RetrieveCredentials request after some time. # Message indicating credential retrieval is pending.
+ },
+ "success": { # Message indicating successful retrieval of credentials. # Message indicating credentials were successfully retrieved.
+ "expireTime": "A String", # The expiration time of the token. This does not guarantee that the token will be valid until this time, since the token could be revoked earlier. There could also be clock skew between the auth provider and the client so it may expire slightly earlier. If not set, the token might be permanent or it may be that the service does not (or cannot) know when it will expire.
+ "header": "A String", # The HTTP header name where the token should be placed.
+ "scopes": [ # The scopes actually associated with the retrieved token. End users may have rejected some requested scopes, or the third-party authorization servers can return a different set of scopes than what was asked for. Callers should verify that all required scopes for their intended use are included in this list.
+ "A String",
+ ],
+ "token": "A String", # The retrieved access token or credential for the end user. On MCPTool call, for an invalid token OAuth spec says this should return 401 or 403, but MCPServers may implement this differently. If you get any flavor of `PERMISSION_DENIED`, retry your original request to RetrieveCredentials with force_refresh_token set to the expired/invalid token string, which will fetch a new token or initiate a new consent flow.
+ },
+ "uriConsentRequired": { # Indicates that the user must visit the provided URI to consent to delegate permission to the agent to act on their behalf. The caller can either poll the `RetrieveCredentials` method, or await the /ValidateUserId callback # Message indicating uri based consent is required.
+ "authorizationUri": "A String", # Output only. The URL where the user should be redirected to grant consent. This will always be present.
+ "consentNonce": "A String", # Output only. A one-time, randomly generated value that validates the entire consent flow is handled by a single user, avoiding CSRF attacks. It must be submitted with the FinalizeCredentials request to complete the OAuth exchange. This will always be present. Implemented per https://www.rfc-editor.org/rfc/rfc6819#section-5.3.5
+ "uid": "A String", # Output only. The unique ID of the credentials retrieval operation.
+ },
+}
+
+ credentials()
+
Returns the credentials Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
+ authProviders()
+
Returns the authProviders Resource.
+ +
+ close()
Close httplib2 connections.
+close()
+ Close httplib2 connections.+
Returns the operations Resource.
+
+ publishers()
+
Returns the publishers Resource.
+Returns the services Resource.
+
+ skills()
+
Returns the skills Resource.
+Close httplib2 connections.
diff --git a/docs/dyn/agentregistry_v1alpha.projects.locations.publishers.html b/docs/dyn/agentregistry_v1alpha.projects.locations.publishers.html new file mode 100644 index 0000000000..d60085930c --- /dev/null +++ b/docs/dyn/agentregistry_v1alpha.projects.locations.publishers.html @@ -0,0 +1,164 @@ + + + +
+ close()
Close httplib2 connections.
+ +Fetches details of a specific Publisher.
+
+ list(parent, pageSize=None, pageToken=None, x__xgafv=None)
Lists all Publishers in a location.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
get(name, x__xgafv=None)
+ Fetches details of a specific Publisher.
+
+Args:
+ name: string, Required. Target publisher resource name. Format: `projects/{project}/locations/{location}/publishers/{publisher}` (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Represents a verified Publisher of Skills. Prepopulated publishers include `publishers/cloud.google.com` and `publishers/workspace.google.com`.
+ "displayName": "A String", # Optional. Human readable display name of the publisher.
+ "documentationUri": "A String", # Optional. URI pointing to official publisher documentation.
+ "name": "A String", # Identifier. Resource name of the publisher. Format: `projects/{project}/locations/{location}/publishers/{publisher}`
+ "publisherTier": "A String", # Output only. The curation tier of the publisher.
+ "supportUri": "A String", # Optional. URI pointing to the support portal or email.
+ "verifiedPrefix": "A String", # Required. The verified prefix (e.g. "snowflake-", "google-") associated with this publisher. The system uses this prefix to enforce name-squatting rules during Skill registration. Must be globally unique across all publishers.
+}
+list(parent, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists all Publishers in a location.
+
+Args:
+ parent: string, Required. Parent location to query. Format: `projects/{project}/locations/{location}` (required)
+ pageSize: integer, Optional. Page limit size.
+ pageToken: string, Optional. Page offset token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response listing Publishers.
+ "nextPageToken": "A String", # Page offset continuation token.
+ "publishers": [ # The returned list of Publishers.
+ { # Represents a verified Publisher of Skills. Prepopulated publishers include `publishers/cloud.google.com` and `publishers/workspace.google.com`.
+ "displayName": "A String", # Optional. Human readable display name of the publisher.
+ "documentationUri": "A String", # Optional. URI pointing to official publisher documentation.
+ "name": "A String", # Identifier. Resource name of the publisher. Format: `projects/{project}/locations/{location}/publishers/{publisher}`
+ "publisherTier": "A String", # Output only. The curation tier of the publisher.
+ "supportUri": "A String", # Optional. URI pointing to the support portal or email.
+ "verifiedPrefix": "A String", # Required. The verified prefix (e.g. "snowflake-", "google-") associated with this publisher. The system uses this prefix to enforce name-squatting rules during Skill registration. Must be globally unique across all publishers.
+ },
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ revisions()
+
Returns the revisions Resource.
+ +
+ close()
Close httplib2 connections.
+
+ create(parent, body=None, requestId=None, skillId=None, x__xgafv=None)
========================================================================= # Skills Collection APIs Creates a Skill resource container, optionally publishing the initial SkillRevision inline in a single, atomic CRUD roundtrip.
+
+ delete(name, force=None, requestId=None, x__xgafv=None)
Deletes a Skill container along with all its revisions.
+ +Fetches the active configuration and metadata of a Skill.
+
+ list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Lists logical Skills available in a project.
+ +Retrieves the next page of results.
+
+ patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
Updates Skill metadata or overrides active pointers/state using REST standard PATCH.
+ +Custom deep-search method to filter by frontmatter or query SKILL.md text blobs.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
create(parent, body=None, requestId=None, skillId=None, x__xgafv=None)
+ ========================================================================= # Skills Collection APIs Creates a Skill resource container, optionally publishing the initial SkillRevision inline in a single, atomic CRUD roundtrip.
+
+Args:
+ parent: string, Required. The project and location location to bootstrap. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Represents an Executable Agent Skill or a Composite Tool Suite (Bundle). Sibling resource with Agent and McpServer under agentregistry.googleapis.com.
+ "createTime": "A String", # Output only. Create time.
+ "defaultRevision": "A String", # Optional. The full resource name of the revision currently served by default (floating track). Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "description": "A String", # Optional. Brief summary describing the capabilities of the skill. Maximum length is 2048 characters.
+ "displayName": "A String", # Required. Human-readable display name of the skill. Maximum length is 128 characters.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Lightweight frontmatter metadata attributes copied from the default revision.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "initialRevision": { # Represents an immutable, versioned snapshot of a Skill package. # Optional. Input only. Optional nested initial revision payload to support standard one-shot creation. The server processes this field on input during creation but must never return it in responses.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+ },
+ "name": "A String", # Identifier. Resource name of the Skill. Format: `projects/{project}/locations/{location}/skills/{skill}` The `{skill}` segment acts as the resource ID. If the skill is associated with a Publisher, this segment typically uses a hyphenated namespace prefix corresponding to the publisher (e.g., `google-workspace-create-docs`).
+ "publisher": "A String", # Optional. The publisher resource associated with this skill. Format: `projects/{project}/locations/{location}/publishers/{publisher}` The publisher dictates the allowed namespace prefixes for the skill's name and logical `skill_id` (e.g., Publisher `google` authorizes the `google-*` prefix).
+ "skillId": "A String", # Output only. A stable, globally unique logical identifier for the skill. It is securely constructed by the backend by combining the associated `publisher`'s verified namespace and the skill's resource ID to enforce strict ownership. For example, the prefix `google-` is reserved exclusively for first-party Google publishers to prevent namespace squatting. Example: `urn:skill:google-workspace:create-docs`
+ "state": "A String", # Output only. The system-managed state of the skill.
+ "targetState": "A String", # Required. User-managed target state of the skill.
+ "type": "A String", # Required. Structural deployment type (SIMPLE leaf vs COMPOSITE bundle).
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the logical container.
+ "updateTime": "A String", # Output only. Update time.
+}
+
+ requestId: string, Optional. Signed UUID request idempotency token.
+ skillId: string, Required. Custom, user-defined unique container identifier. Must be unique within the parent project and location. This value should be 4-63 characters, and valid characters are `/a-z-/`.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # This resource represents a long-running operation that is the result of a network API call.
+ "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+ "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+ "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+ "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+ {
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ ],
+ "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+ },
+ "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+ "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+}
+delete(name, force=None, requestId=None, x__xgafv=None)
+ Deletes a Skill container along with all its revisions.
+
+Args:
+ name: string, Required. Target Skill container name to remove. (required)
+ force: boolean, Optional. If set to true, any child SkillRevisions under this Skill will also be deleted. Otherwise, the request will only succeed if the Skill has no child SkillRevisions.
+ requestId: string, Optional. Signed UUID request idempotency token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # This resource represents a long-running operation that is the result of a network API call.
+ "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+ "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+ "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+ "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+ {
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ ],
+ "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+ },
+ "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+ "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+}
+get(name, x__xgafv=None)
+ Fetches the active configuration and metadata of a Skill.
+
+Args:
+ name: string, Required. Target resource container name. (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Represents an Executable Agent Skill or a Composite Tool Suite (Bundle). Sibling resource with Agent and McpServer under agentregistry.googleapis.com.
+ "createTime": "A String", # Output only. Create time.
+ "defaultRevision": "A String", # Optional. The full resource name of the revision currently served by default (floating track). Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "description": "A String", # Optional. Brief summary describing the capabilities of the skill. Maximum length is 2048 characters.
+ "displayName": "A String", # Required. Human-readable display name of the skill. Maximum length is 128 characters.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Lightweight frontmatter metadata attributes copied from the default revision.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "initialRevision": { # Represents an immutable, versioned snapshot of a Skill package. # Optional. Input only. Optional nested initial revision payload to support standard one-shot creation. The server processes this field on input during creation but must never return it in responses.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+ },
+ "name": "A String", # Identifier. Resource name of the Skill. Format: `projects/{project}/locations/{location}/skills/{skill}` The `{skill}` segment acts as the resource ID. If the skill is associated with a Publisher, this segment typically uses a hyphenated namespace prefix corresponding to the publisher (e.g., `google-workspace-create-docs`).
+ "publisher": "A String", # Optional. The publisher resource associated with this skill. Format: `projects/{project}/locations/{location}/publishers/{publisher}` The publisher dictates the allowed namespace prefixes for the skill's name and logical `skill_id` (e.g., Publisher `google` authorizes the `google-*` prefix).
+ "skillId": "A String", # Output only. A stable, globally unique logical identifier for the skill. It is securely constructed by the backend by combining the associated `publisher`'s verified namespace and the skill's resource ID to enforce strict ownership. For example, the prefix `google-` is reserved exclusively for first-party Google publishers to prevent namespace squatting. Example: `urn:skill:google-workspace:create-docs`
+ "state": "A String", # Output only. The system-managed state of the skill.
+ "targetState": "A String", # Required. User-managed target state of the skill.
+ "type": "A String", # Required. Structural deployment type (SIMPLE leaf vs COMPOSITE bundle).
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the logical container.
+ "updateTime": "A String", # Output only. Update time.
+}
+list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists logical Skills available in a project.
+
+Args:
+ parent: string, Required. Parent value for ListSkillsRequest (required)
+ filter: string, Optional. Use this field to specify filter criteria on list results. Filter expressions can be used to restrict results based upon filterable fields, where equality operators can be used. See [instructions](https://docs.cloud.google.com/agent-registry/search-agents-and-tools) for more details. Allowed operators: `=`, `<`, `>`, `NOT`, `AND`, `OR`, and `()`. | Field | `=` | `<`, `>` | |--------------|-----|----------| | state | Yes | No | | targetState | Yes | No | | createTime | Yes | Yes | | updateTime | Yes | Yes | Examples: * `state=ACTIVE` to restrict results to skills in the `ACTIVE` state.
+ orderBy: string, Optional. Hint for how to order the results
+ pageSize: integer, Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
+ pageToken: string, Optional. A token identifying a page of results the server should return.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response structure listing logical Skills.
+ "nextPageToken": "A String", # Page continuation continuation token.
+ "skills": [ # Returned container list.
+ { # Represents an Executable Agent Skill or a Composite Tool Suite (Bundle). Sibling resource with Agent and McpServer under agentregistry.googleapis.com.
+ "createTime": "A String", # Output only. Create time.
+ "defaultRevision": "A String", # Optional. The full resource name of the revision currently served by default (floating track). Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "description": "A String", # Optional. Brief summary describing the capabilities of the skill. Maximum length is 2048 characters.
+ "displayName": "A String", # Required. Human-readable display name of the skill. Maximum length is 128 characters.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Lightweight frontmatter metadata attributes copied from the default revision.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "initialRevision": { # Represents an immutable, versioned snapshot of a Skill package. # Optional. Input only. Optional nested initial revision payload to support standard one-shot creation. The server processes this field on input during creation but must never return it in responses.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+ },
+ "name": "A String", # Identifier. Resource name of the Skill. Format: `projects/{project}/locations/{location}/skills/{skill}` The `{skill}` segment acts as the resource ID. If the skill is associated with a Publisher, this segment typically uses a hyphenated namespace prefix corresponding to the publisher (e.g., `google-workspace-create-docs`).
+ "publisher": "A String", # Optional. The publisher resource associated with this skill. Format: `projects/{project}/locations/{location}/publishers/{publisher}` The publisher dictates the allowed namespace prefixes for the skill's name and logical `skill_id` (e.g., Publisher `google` authorizes the `google-*` prefix).
+ "skillId": "A String", # Output only. A stable, globally unique logical identifier for the skill. It is securely constructed by the backend by combining the associated `publisher`'s verified namespace and the skill's resource ID to enforce strict ownership. For example, the prefix `google-` is reserved exclusively for first-party Google publishers to prevent namespace squatting. Example: `urn:skill:google-workspace:create-docs`
+ "state": "A String", # Output only. The system-managed state of the skill.
+ "targetState": "A String", # Required. User-managed target state of the skill.
+ "type": "A String", # Required. Structural deployment type (SIMPLE leaf vs COMPOSITE bundle).
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the logical container.
+ "updateTime": "A String", # Output only. Update time.
+ },
+ ],
+ "unreachable": [ # Unreachable locations or failures.
+ "A String",
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)
+ Updates Skill metadata or overrides active pointers/state using REST standard PATCH.
+
+Args:
+ name: string, Identifier. Resource name of the Skill. Format: `projects/{project}/locations/{location}/skills/{skill}` The `{skill}` segment acts as the resource ID. If the skill is associated with a Publisher, this segment typically uses a hyphenated namespace prefix corresponding to the publisher (e.g., `google-workspace-create-docs`). (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Represents an Executable Agent Skill or a Composite Tool Suite (Bundle). Sibling resource with Agent and McpServer under agentregistry.googleapis.com.
+ "createTime": "A String", # Output only. Create time.
+ "defaultRevision": "A String", # Optional. The full resource name of the revision currently served by default (floating track). Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "description": "A String", # Optional. Brief summary describing the capabilities of the skill. Maximum length is 2048 characters.
+ "displayName": "A String", # Required. Human-readable display name of the skill. Maximum length is 128 characters.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Lightweight frontmatter metadata attributes copied from the default revision.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "initialRevision": { # Represents an immutable, versioned snapshot of a Skill package. # Optional. Input only. Optional nested initial revision payload to support standard one-shot creation. The server processes this field on input during creation but must never return it in responses.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+ },
+ "name": "A String", # Identifier. Resource name of the Skill. Format: `projects/{project}/locations/{location}/skills/{skill}` The `{skill}` segment acts as the resource ID. If the skill is associated with a Publisher, this segment typically uses a hyphenated namespace prefix corresponding to the publisher (e.g., `google-workspace-create-docs`).
+ "publisher": "A String", # Optional. The publisher resource associated with this skill. Format: `projects/{project}/locations/{location}/publishers/{publisher}` The publisher dictates the allowed namespace prefixes for the skill's name and logical `skill_id` (e.g., Publisher `google` authorizes the `google-*` prefix).
+ "skillId": "A String", # Output only. A stable, globally unique logical identifier for the skill. It is securely constructed by the backend by combining the associated `publisher`'s verified namespace and the skill's resource ID to enforce strict ownership. For example, the prefix `google-` is reserved exclusively for first-party Google publishers to prevent namespace squatting. Example: `urn:skill:google-workspace:create-docs`
+ "state": "A String", # Output only. The system-managed state of the skill.
+ "targetState": "A String", # Required. User-managed target state of the skill.
+ "type": "A String", # Required. Structural deployment type (SIMPLE leaf vs COMPOSITE bundle).
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the logical container.
+ "updateTime": "A String", # Output only. Update time.
+}
+
+ requestId: string, Optional. Signed UUID request idempotency token.
+ updateMask: string, Optional. Standard update target mask mapping relative fields.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # This resource represents a long-running operation that is the result of a network API call.
+ "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+ "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+ "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+ "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+ {
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ ],
+ "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+ },
+ "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+ "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+}
+search(parent, filter=None, pageSize=None, pageToken=None, searchString=None, searchType=None, x__xgafv=None)
+ Custom deep-search method to filter by frontmatter or query SKILL.md text blobs.
+
+Args:
+ parent: string, Required. Parent value for SearchSkillsRequest. Format: `projects/{project}/locations/{location}`. (required)
+ filter: string, Optional. Use this field to specify additional filter criteria on search results. Filter expressions can be used to restrict results based upon filterable fields, where equality operators can be used. See [instructions](https://docs.cloud.google.com/agent-registry/search-agents-and-tools) for more details. Allowed operators: `=`, `<`, `>`, `NOT`, `AND`, `OR`, and `()`. | Field | `=` | `<`, `>` | |--------------|-----|----------| | state | Yes | No | | targetState | Yes | No | | createTime | Yes | Yes | | updateTime | Yes | Yes | Examples: * `state=ACTIVE` to restrict results to skills in the `ACTIVE` state.
+ pageSize: integer, Optional. The maximum number of search results to return per page. The page size is capped at `100`, even if a larger value is specified. A negative value will result in an `INVALID_ARGUMENT` error. If unspecified or set to `0`, a default value of `20` will be used. The server may return fewer results than requested.
+ pageToken: string, Optional. If present, retrieve the next batch of results from the preceding call to this method. `page_token` must be the value of `next_page_token` from the previous response. The values of all other method parameters, must be identical to those in the previous call.
+ searchString: string, Optional. Search criteria used to select the Skills to return. If no search criteria is specified then all accessible Skills will be returned. Search expressions can be used to restrict results based upon searchable fields, where the operators can be used along with the suffix wildcard symbol `*`. See [instructions](https://docs.cloud.google.com/agent-registry/search-agents-and-tools) for more details. Allowed operators: `=`, `:`, `NOT`, `AND`, `OR`, and `()`. Searchable fields: | Field | `=` | `:` | `*` | Keyword Search | |---------------------------|-----|-----|-----|----------------| | skillId | Yes | Yes | Yes | Included | | name | No | Yes | Yes | Included | | displayName | No | Yes | Yes | Included | | description | No | Yes | No | Included | | frontmatter.name | No | Yes | No | Included | | frontmatter.description | No | Yes | No | Included | | frontmatter.compatibility | No | Yes | No | Included | | frontmatter.license | No | Yes | No | Included | Examples: * `skillId="urn:skill:projects-1234:locations:global:private-important-skill"` to find the skill with the specified skill ID. * `name:important` to find skills whose name contains `important` as a word. * `displayName:works*` to find skills whose display name contains words that start with `works`.
+ searchType: string, Optional. The type of search.
+ Allowed values
+ SEARCH_TYPE_UNSPECIFIED - Invalid search type.
+ KEYWORD - Search for a keyword across all searchable fields.
+ SEMANTIC - Search based on the meaning and intent of a natural language query.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response listing searched Skills.
+ "nextPageToken": "A String", # Query page offset continuation token.
+ "skills": [ # Matched Skills list.
+ { # Represents an Executable Agent Skill or a Composite Tool Suite (Bundle). Sibling resource with Agent and McpServer under agentregistry.googleapis.com.
+ "createTime": "A String", # Output only. Create time.
+ "defaultRevision": "A String", # Optional. The full resource name of the revision currently served by default (floating track). Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "description": "A String", # Optional. Brief summary describing the capabilities of the skill. Maximum length is 2048 characters.
+ "displayName": "A String", # Required. Human-readable display name of the skill. Maximum length is 128 characters.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Lightweight frontmatter metadata attributes copied from the default revision.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "initialRevision": { # Represents an immutable, versioned snapshot of a Skill package. # Optional. Input only. Optional nested initial revision payload to support standard one-shot creation. The server processes this field on input during creation but must never return it in responses.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+ },
+ "name": "A String", # Identifier. Resource name of the Skill. Format: `projects/{project}/locations/{location}/skills/{skill}` The `{skill}` segment acts as the resource ID. If the skill is associated with a Publisher, this segment typically uses a hyphenated namespace prefix corresponding to the publisher (e.g., `google-workspace-create-docs`).
+ "publisher": "A String", # Optional. The publisher resource associated with this skill. Format: `projects/{project}/locations/{location}/publishers/{publisher}` The publisher dictates the allowed namespace prefixes for the skill's name and logical `skill_id` (e.g., Publisher `google` authorizes the `google-*` prefix).
+ "skillId": "A String", # Output only. A stable, globally unique logical identifier for the skill. It is securely constructed by the backend by combining the associated `publisher`'s verified namespace and the skill's resource ID to enforce strict ownership. For example, the prefix `google-` is reserved exclusively for first-party Google publishers to prevent namespace squatting. Example: `urn:skill:google-workspace:create-docs`
+ "state": "A String", # Output only. The system-managed state of the skill.
+ "targetState": "A String", # Required. User-managed target state of the skill.
+ "type": "A String", # Required. Structural deployment type (SIMPLE leaf vs COMPOSITE bundle).
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the logical container.
+ "updateTime": "A String", # Output only. Update time.
+ },
+ ],
+}
+search_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
+ close()
Close httplib2 connections.
+
+ create(parent, body=None, requestId=None, skillRevisionId=None, x__xgafv=None)
Creates a new immutable revision and triggers validation pipelines.
+
+ delete(name, requestId=None, x__xgafv=None)
Deletes a specific revision (restricted to admins to purge accidentally committed secrets).
+ +Gets details of a single immutable Revision.
+
+ get_media(name, x__xgafv=None)
Gets details of a single immutable Revision.
+
+ list(parent, pageSize=None, pageToken=None, x__xgafv=None)
Lists all revisions belonging to a parent Skill.
+ +Retrieves the next page of results.
+close()
+ Close httplib2 connections.+
create(parent, body=None, requestId=None, skillRevisionId=None, x__xgafv=None)
+ Creates a new immutable revision and triggers validation pipelines.
+
+Args:
+ parent: string, Required. Parent logical container name. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # Represents an immutable, versioned snapshot of a Skill package.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+}
+
+ requestId: string, Optional. Signed UUID request idempotency token.
+ skillRevisionId: string, Optional. Custom, user-defined unique revision identifier. Format: 4-63 characters, matching regex `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # This resource represents a long-running operation that is the result of a network API call.
+ "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+ "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+ "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+ "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+ {
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ ],
+ "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+ },
+ "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+ "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+}
+delete(name, requestId=None, x__xgafv=None)
+ Deletes a specific revision (restricted to admins to purge accidentally committed secrets).
+
+Args:
+ name: string, Required. Target revision name to remove. (required)
+ requestId: string, Optional. Signed UUID request idempotency token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # This resource represents a long-running operation that is the result of a network API call.
+ "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+ "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+ "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+ "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+ {
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ ],
+ "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+ },
+ "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+ "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+}
+get(name, x__xgafv=None)
+ Gets details of a single immutable Revision.
+
+Args:
+ name: string, Required. Target revision name. (required)
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Represents an immutable, versioned snapshot of a Skill package.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+}
+get_media(name, x__xgafv=None)
+ Gets details of a single immutable Revision. + +Args: + name: string, Required. Target revision name. (required) + x__xgafv: string, V1 error format. + Allowed values + 1 - v1 error format + 2 - v2 error format + +Returns: + The media object as a string. + ++
list(parent, pageSize=None, pageToken=None, x__xgafv=None)
+ Lists all revisions belonging to a parent Skill.
+
+Args:
+ parent: string, Required. Parent logical container name to query. (required)
+ pageSize: integer, Optional. Page limit size.
+ pageToken: string, Optional. Page offset token.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # Response listing Revisions.
+ "nextPageToken": "A String", # Page offset continuation token.
+ "skillRevisions": [ # Returned version snapshot list.
+ { # Represents an immutable, versioned snapshot of a Skill package.
+ "archiveUploadSource": { # Direct write-only raw archive payload upload. # Optional. Immutable. Direct write-only raw archive upload source.
+ "archiveContent": "A String", # Required. Input only. Write-only raw ZIP/TAR archive payload bytes containing the skill package.
+ },
+ "createTime": "A String", # Output only. Revision creation timestamp.
+ "frontmatter": { # Structured metadata attributes extracted from the package's local SKILL.md frontmatter. # Output only. Extracted YAML frontmatter configuration snapshot.
+ "compatibility": "A String", # Optional. Environmental dependencies or local sidecars.
+ "description": "A String", # Required. Functional description.
+ "license": "A String", # Optional. License.
+ "metadata": { # Optional. Extensible flattened map mapping custom tags, authors, and version parameters.
+ "a_key": "A String",
+ },
+ "name": "A String", # Required. The name of the skill.
+ },
+ "gcsSource": { # Specifications for Cloud Storage objects. # Optional. Immutable. Cloud Storage object generation URI.
+ "generation": "A String", # Optional. Cloud Storage object generation ID. If not specified, the latest generation is used.
+ "uri": "A String", # Required. Cloud Storage object URI. Format: `gs://{bucket_name}/{object_name}`
+ },
+ "name": "A String", # Identifier. Resource name of the SkillRevision. Format: `projects/{project}/locations/{location}/skills/{skill}/revisions/{revision}`
+ "sha256Hash": "A String", # Output only. Cryptographic SHA-256 integrity and deduplication digest of the payload zip.
+ "sizeBytes": "A String", # Output only. Size of the compiled zip payload in bytes (assists client download progress).
+ "state": "A String", # Output only. The system-managed lifecycle state of this revision.
+ "uid": "A String", # Output only. Universally unique identifier (UUID4) for the skill revision.
+ },
+ ],
+}
+list_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
list_next()
Retrieves the next page of results.
- mutateDeployedIndex(indexEndpoint, body=None, x__xgafv=None)
mutateDeployedIndex(indexEndpoint, body=None, updateMask=None, x__xgafv=None)
Update an existing DeployedIndex under an IndexEndpoint.
patch(name, body=None, updateMask=None, x__xgafv=None)
mutateDeployedIndex(indexEndpoint, body=None, x__xgafv=None)
+ mutateDeployedIndex(indexEndpoint, body=None, updateMask=None, x__xgafv=None)
Update an existing DeployedIndex under an IndexEndpoint. Args: @@ -921,6 +921,7 @@Method Details
], } + updateMask: string, Optional. The update mask applies to the resource. The supported paths are `automatic_resources`, `dedicated_resources`, `enable_access_logging` and `deployed_index_auth_config`. When omitted, the service will perform a full update of all fields. See google.protobuf.FieldMask. x__xgafv: string, V1 error format. Allowed values 1 - v1 error format diff --git a/docs/dyn/aiplatform_v1.projects.locations.memoryBanks.html b/docs/dyn/aiplatform_v1.projects.locations.memoryBanks.html index 869428ee88..af6a5b8a84 100644 --- a/docs/dyn/aiplatform_v1.projects.locations.memoryBanks.html +++ b/docs/dyn/aiplatform_v1.projects.locations.memoryBanks.html @@ -87,10 +87,175 @@Instance Methods
Close httplib2 connections.
++
+ingestEvents(parent, body=None, x__xgafv=None)Ingests events for a Memory Bank.
Method Details
+close()Close httplib2 connections.++ingestEvents(parent, body=None, x__xgafv=None)+Ingests events for a Memory Bank. + +Args: + parent: string, Required. The resource name of the ReasoningEngine to ingest events to. Format: `projects/{project}/locations/{location}/reasoningEngines/{reasoning_engine}` (required) + body: object, The request body. + The object takes the form of: + +{ # Request message for MemoryBankService.IngestEvents. + "directContentsSource": { # Ingest events directly from the request. # Ingest events directly from the request. + "events": [ # Required. The events to ingest. + { # A single event to ingest. + "content": { # The structured data content of a message. A Content message contains a `role` field, which indicates the producer of the content, and a `parts` field, which contains the multi-part data of the message. # Required. The content of the event. + "parts": [ # Required. A list of Part objects that make up a single message. Parts of a message can have different MIME types. A Content message must have at least one Part. + { # A datatype containing media that is part of a multi-part Content message. A `Part` consists of data which has an associated datatype. A `Part` can only contain one of the accepted types in `Part.data`. For media types that are not text, `Part` must have a fixed IANA MIME type identifying the type and subtype of the media if `inline_data` or `file_data` field is filled with raw bytes. + "audioTranscription": { # The transcription of an audio part. For multi-speaker audio, each speaker segment is a separate Part with its own AudioTranscription carrying the speaker_label. # Optional. Audio (input or output) transcription. This is only set when this Part contains audio data. + "speakerLabel": "A String", # Optional. A label identifying the speaker of this audio segment (e.g. "spk_1", "spk_2"). Present when diarization is set. + "text": "A String", # Required. The transcription text of this audio segment. + "words": [ # Optional. Detailed word-level transcriptions and timing details. Present when word_timestamp is set. + { # Information about a single recognized word. + "endOffset": "A String", # Optional. End offset in time of the word relative to the start of the audio. + "startOffset": "A String", # Optional. Start offset in time of the word relative to the start of the audio. + "word": "A String", # Required. Transcript of the word. + }, + ], + }, + "codeExecutionResult": { # Result of executing the ExecutableCode. Generated only when the `CodeExecution` tool is used. # Optional. The result of executing the ExecutableCode. + "outcome": "A String", # Required. Outcome of the code execution. + "output": "A String", # Optional. Contains stdout when code execution is successful, stderr or other description otherwise. + }, + "executableCode": { # Code generated by the model that is meant to be executed, and the result returned to the model. Generated when using the `CodeExecution` tool, in which the code will be automatically executed, and a corresponding CodeExecutionResult will also be generated. # Optional. Code generated by the model that is intended to be executed. + "code": "A String", # Required. The code to be executed. + "language": "A String", # Required. Programming language of the `code`. + }, + "fileData": { # URI-based data. A FileData message contains a URI pointing to data of a specific media type. It is used to represent images, audio, and video stored in Google Cloud Storage. # Optional. The URI-based data of the part. This can be used to include files from Google Cloud Storage. + "displayName": "A String", # Optional. The display name of the file. Used to provide a label or filename to distinguish files. This field is only returned in `PromptMessage` for prompt management. It is used in the Gemini calls only when server side tools (`code_execution`, `google_search`, and `url_context`) are enabled. + "fileUri": "A String", # Required. The URI of the file in Google Cloud Storage. + "mimeType": "A String", # Required. The IANA standard MIME type of the source data. + }, + "functionCall": { # A predicted FunctionCall returned from the model that contains a string representing the FunctionDeclaration.name and a structured JSON object containing the parameters and their values. # Optional. A predicted function call returned from the model. This contains the name of the function to call and the arguments to pass to the function. + "args": { # Optional. The function parameters and values in JSON object format. See FunctionDeclaration.parameters for parameter details. + "a_key": "", # Properties of the object. + }, + "name": "A String", # Optional. The name of the function to call. Matches FunctionDeclaration.name. + "partialArgs": [ # Optional. The partial argument value of the function call. If provided, represents the arguments/fields that are streamed incrementally. + { # Partial argument value of the function call. + "boolValue": True or False, # Optional. Represents a boolean value. + "jsonPath": "A String", # Required. A JSON Path (RFC 9535) to the argument being streamed. https://datatracker.ietf.org/doc/html/rfc9535. e.g. "$.foo.bar[0].data". + "nullValue": "A String", # Optional. Represents a null value. + "numberValue": 3.14, # Optional. Represents a double value. + "stringValue": "A String", # Optional. Represents a string value. + "willContinue": True or False, # Optional. Whether this is not the last part of the same json_path. If true, another PartialArg message for the current json_path is expected to follow. + }, + ], + "willContinue": True or False, # Optional. Whether this is the last part of the FunctionCall. If true, another partial message for the current FunctionCall is expected to follow. + }, + "functionResponse": { # The result output from a FunctionCall that contains a string representing the FunctionDeclaration.name and a structured JSON object containing any output from the function is used as context to the model. This should contain the result of a `FunctionCall` made based on model prediction. # Optional. The result of a function call. This is used to provide the model with the result of a function call that it predicted. + "name": "A String", # Required. The name of the function to call. Matches FunctionDeclaration.name and FunctionCall.name. + "parts": [ # Optional. Ordered `Parts` that constitute a function response. Parts may have different IANA MIME types. + { # A datatype containing media that is part of a `FunctionResponse` message. A `FunctionResponsePart` consists of data which has an associated datatype. A `FunctionResponsePart` can only contain one of the accepted types in `FunctionResponsePart.data`. A `FunctionResponsePart` must have a fixed IANA MIME type identifying the type and subtype of the media if the `inline_data` field is filled with raw bytes. + "fileData": { # URI based data for function response. # URI based data. + "displayName": "A String", # Optional. Display name of the file data. Used to provide a label or filename to distinguish file datas. This field is only returned in PromptMessage for prompt management. It is currently used in the Gemini GenerateContent calls only when server side tools (code_execution, google_search, and url_context) are enabled. + "fileUri": "A String", # Required. URI. + "mimeType": "A String", # Required. The IANA standard MIME type of the source data. + }, + "inlineData": { # Raw media bytes for function response. Text should not be sent as raw bytes, use the 'text' field. # Inline media bytes. + "data": "A String", # Required. Raw bytes. + "displayName": "A String", # Optional. Display name of the blob. Used to provide a label or filename to distinguish blobs. This field is only returned in PromptMessage for prompt management. It is currently used in the Gemini GenerateContent calls only when server side tools (code_execution, google_search, and url_context) are enabled. + "mimeType": "A String", # Required. The IANA standard MIME type of the source data. + }, + }, + ], + "response": { # Required. The function response in JSON object format. Use "output" key to specify function output and "error" key to specify error details (if any). If "output" and "error" keys are not specified, then whole "response" is treated as function output. + "a_key": "", # Properties of the object. + }, + "scheduling": "A String", # Optional. Specifies how the response should be scheduled in the conversation. Only applicable to NON_BLOCKING function calls, is ignored otherwise. Defaults to WHEN_IDLE. + }, + "inlineData": { # A content blob. A Blob contains data of a specific media type. It is used to represent images, audio, and video. # Optional. The inline data content of the part. This can be used to include images, audio, or video in a request. + "data": "A String", # Required. The raw bytes of the data. + "displayName": "A String", # Optional. The display name of the blob. Used to provide a label or filename to distinguish blobs. This field is only returned in `PromptMessage` for prompt management. It is used in the Gemini calls only when server-side tools (`code_execution`, `google_search`, and `url_context`) are enabled. + "mimeType": "A String", # Required. The IANA standard MIME type of the source data. + }, + "mediaResolution": { # per part media resolution. Media resolution for the input media. # per part media resolution. Media resolution for the input media. + "level": "A String", # The tokenization quality used for given media. + }, + "text": "A String", # Optional. The text content of the part. When sent from the VSCode Gemini Code Assist extension, references to @mentioned items will be converted to markdown boldface text. For example `@my-repo` will be converted to and sent as `**my-repo**` by the IDE agent. + "thought": True or False, # Optional. Indicates whether the `part` represents the model's thought process or reasoning. + "thoughtSignature": "A String", # Optional. An opaque signature for the thought so it can be reused in subsequent requests. + "videoMetadata": { # Provides metadata for a video, including the start and end offsets for clipping and the frame rate. # Optional. Video metadata. The metadata should only be specified while the video data is presented in inline_data or file_data. + "endOffset": "A String", # Optional. The end offset of the video. + "fps": 3.14, # Optional. The frame rate of the video sent to the model. If not specified, the default value is 1.0. The valid range is (0.0, 24.0]. + "startOffset": "A String", # Optional. The start offset of the video. + }, + }, + ], + "role": "A String", # Optional. The producer of the content. Must be either 'user' or 'model'. If not set, the service will default to 'user'. + }, + "eventId": "A String", # Optional. A unique identifier for the event. If an event with the same event_id is ingested multiple times, it will be de-duplicated. + "eventTime": "A String", # Optional. The time at which the event occurred. If provided, this timestamp will be used for ordering events within a stream. If not provided, the server-side ingestion time will be used. + }, + ], + }, + "disableMemoryRevisions": True or False, # Optional. If true, no revisions will be created for this request. + "forceFlush": True or False, # Optional. Forces a flush of all pending events in the stream and triggers memory generation immediately bypassing any conditions configured in the `generation_trigger_config`. + "generationTriggerConfig": { # Represents configuration for triggering generation. # Optional. Configuration for triggering memory generation from this ingestion. If not set, then the stream will be force flushed immediately. + "generationRule": { # Represents the active rule that determines when to flush the buffer. # Optional. Represents the active rule that determines when to flush the buffer. If not set, then the stream will be force flushed immediately. + "eventCount": 42, # Optional. Specifies to trigger generation when the event count reaches this limit. + "fixedInterval": "A String", # Optional. Specifies to trigger generation at a fixed interval. The duration must have a minute-level granularity. + "idleDuration": "A String", # Optional. Specifies to trigger generation if the stream is inactive for the specified duration after the most recent event. The duration must have a minute-level granularity. + "overlapEventCount": 42, # Optional. Re-include the last N already-processed events in the next window. + }, + }, + "metadata": { # Optional. User-provided metadata for the generated memories. This is not generated by Memory Bank. + "a_key": { # Memory metadata. + "boolValue": True or False, # Represents a boolean value. + "doubleValue": 3.14, # Represents a double value. + "stringValue": "A String", # Represents a string value. + "timestampValue": "A String", # Represents a timestamp value. When filtering on timestamp values, only the seconds field will be compared. + }, + }, + "metadataMergeStrategy": "A String", # Optional. The strategy to use when applying metadata to existing memories. + "revisionExpireTime": "A String", # Optional. Timestamp of when the revision is considered expired. If not set, the memory revision will be kept until manually deleted. + "revisionLabels": { # Optional. Labels to be applied to the generated memory revisions. For example, you can use this to label a revision with its data source. + "a_key": "A String", + }, + "revisionTtl": "A String", # Optional. The TTL for the revision. The expiration time is computed: now + TTL. + "scope": { # Required. The scope of the memories that should be generated from the stream. Memories will be consolidated across memories with the same scope. Scope values cannot contain the wildcard character '*'. + "a_key": "A String", + }, + "streamId": "A String", # Optional. The ID of the stream to ingest events into. If not provided, a new one will be created. +} + + x__xgafv: string, V1 error format. + Allowed values + 1 - v1 error format + 2 - v2 error format + +Returns: + An object of the form: + + { # This resource represents a long-running operation that is the result of a network API call. + "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. + "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. + "code": 42, # The status code, which should be an enum value of google.rpc.Code. + "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. + { + "a_key": "", # Properties of the object. Contains field @type with type URL. + }, + ], + "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. + }, + "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. + "a_key": "", # Properties of the object. Contains field @type with type URL. + }, + "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. + "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. + "a_key": "", # Properties of the object. Contains field @type with type URL. + }, +}+