docs: update docs (#916)

* fix: re-run script

* test: fix noxfile
diff --git a/docs/dyn/cloudidentity_v1beta1.groups.memberships.html b/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
index ae414b8..7310699 100644
--- a/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
+++ b/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
@@ -90,7 +90,7 @@
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
-  <code><a href="#lookup">lookup(parent, memberKey_namespace=None, memberKey_id=None, x__xgafv=None)</a></code></p>
+  <code><a href="#lookup">lookup(parent, memberKey_id=None, memberKey_namespace=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Looks up the [resource</p>
 <p class="toc_element">
   <code><a href="#modifyMembershipRoles">modifyMembershipRoles(name, body=None, x__xgafv=None)</a></code></p>
@@ -111,8 +111,7 @@
     # 
     # A `Membership` defines a relationship between a `Group` and an entity
     # belonging to that `Group`, referred to as a &quot;member&quot;.
-  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
-  &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
+  &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
       # 
       # Either `member_key` or `preferred_member_key` must be set when calling
       # MembershipsService.CreateMembership but not both; both shall be set
@@ -121,14 +120,6 @@
       # An entity can represent either a group with an optional `namespace` or a user
       # without a `namespace`. The combination of `id` and `namespace` must be
       # unique; however, the same `id` can be used with different `namespace`s.
-    &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-        #
-        # If not specified, the `EntityKey` represents a Google-managed entity such
-        # as a Google user or a Google Group.
-        #
-        # If specified, the `EntityKey` represents an external-identity-mapped group.
-        # The namespace must correspond to an identity source created in Admin
-        # Console and must be in the form of `identitysources/{identity_source_id}.
     &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
         #
         # For Google-managed entities, the `id` must be the email address of an
@@ -138,11 +129,44 @@
         # to the Identity Source&#x27;s requirements.
         #
         # Must be unique within a `namespace`.
+    &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+        #
+        # If not specified, the `EntityKey` represents a Google-managed entity such
+        # as a Google user or a Google Group.
+        #
+        # If specified, the `EntityKey` represents an external-identity-mapped group.
+        # The namespace must correspond to an identity source created in Admin
+        # Console and must be in the form of `identitysources/{identity_source_id}.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-      # the `Membership`.
+  &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
       # 
-      # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+      # Either `member_key` or `preferred_member_key` must be set when calling
+      # MembershipsService.CreateMembership but not both; both shall be set
+      # when returned.
+      #
+      # An entity can represent either a group with an optional `namespace` or a user
+      # without a `namespace`. The combination of `id` and `namespace` must be
+      # unique; however, the same `id` can be used with different `namespace`s.
+    &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+        #
+        # For Google-managed entities, the `id` must be the email address of an
+        # existing group or user.
+        #
+        # For external-identity-mapped entities, the `id` must be a string conforming
+        # to the Identity Source&#x27;s requirements.
+        #
+        # Must be unique within a `namespace`.
+    &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+        #
+        # If not specified, the `EntityKey` represents a Google-managed entity such
+        # as a Google user or a Google Group.
+        #
+        # If specified, the `EntityKey` represents an external-identity-mapped group.
+        # The namespace must correspond to an identity source created in Admin
+        # Console and must be in the form of `identitysources/{identity_source_id}.
+  },
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
   &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
       # 
       # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -156,34 +180,10 @@
           # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
     },
   ],
-  &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+      # the `Membership`.
       # 
-      # Either `member_key` or `preferred_member_key` must be set when calling
-      # MembershipsService.CreateMembership but not both; both shall be set
-      # when returned.
-      #
-      # An entity can represent either a group with an optional `namespace` or a user
-      # without a `namespace`. The combination of `id` and `namespace` must be
-      # unique; however, the same `id` can be used with different `namespace`s.
-    &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-        #
-        # If not specified, the `EntityKey` represents a Google-managed entity such
-        # as a Google user or a Google Group.
-        #
-        # If specified, the `EntityKey` represents an external-identity-mapped group.
-        # The namespace must correspond to an identity source created in Admin
-        # Console and must be in the form of `identitysources/{identity_source_id}.
-    &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-        #
-        # For Google-managed entities, the `id` must be the email address of an
-        # existing group or user.
-        #
-        # For external-identity-mapped entities, the `id` must be a string conforming
-        # to the Identity Source&#x27;s requirements.
-        #
-        # Must be unique within a `namespace`.
-  },
-  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+      # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
 }
 
   x__xgafv: string, V1 error format.
@@ -196,18 +196,33 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
-    &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress.
-        # If `true`, the operation is completed, and either `error` or `response` is
-        # available.
-    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
+    &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
+        # different programming environments, including REST APIs and RPC APIs. It is
+        # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+        # three pieces of data: error code, error message, and error details.
+        #
+        # You can find out more about this error model and how to work with it in the
+        # [API Design Guide](https://cloud.google.com/apis/design/errors).
+      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+          # user-facing error message should be localized and sent in the
+          # google.rpc.Status.details field, or localized by the client.
+      &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+          # message types for APIs to use.
+        {
+          &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+        },
+      ],
+      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    },
     &quot;metadata&quot;: { # Service-specific metadata associated with the operation.  It typically
         # contains progress information and common metadata such as create time.
         # Some services might not provide such metadata.  Any method that returns a
         # long-running operation should document the metadata type, if any.
       &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
     },
+    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     &quot;response&quot;: { # The normal response of the operation in case of success.  If the original
         # method returns no data on success, such as `Delete`, the response is
         # `google.protobuf.Empty`.  If the original method is standard
@@ -218,24 +233,9 @@
         # `TakeSnapshotResponse`.
       &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
     },
-    &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
-        # different programming environments, including REST APIs and RPC APIs. It is
-        # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-        # three pieces of data: error code, error message, and error details.
-        #
-        # You can find out more about this error model and how to work with it in the
-        # [API Design Guide](https://cloud.google.com/apis/design/errors).
-      &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-          # message types for APIs to use.
-        {
-          &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-        },
-      ],
-      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-          # user-facing error message should be localized and sent in the
-          # google.rpc.Status.details field, or localized by the client.
-      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-    },
+    &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress.
+        # If `true`, the operation is completed, and either `error` or `response` is
+        # available.
   }</pre>
 </div>
 
@@ -258,18 +258,33 @@
 
     { # This resource represents a long-running operation that is the result of a
       # network API call.
-    &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress.
-        # If `true`, the operation is completed, and either `error` or `response` is
-        # available.
-    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
-        # originally returns it. If you use the default HTTP mapping, the
-        # `name` should be a resource name ending with `operations/{unique_id}`.
+    &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
+        # different programming environments, including REST APIs and RPC APIs. It is
+        # used by [gRPC](https://github.com/grpc). Each `Status` message contains
+        # three pieces of data: error code, error message, and error details.
+        #
+        # You can find out more about this error model and how to work with it in the
+        # [API Design Guide](https://cloud.google.com/apis/design/errors).
+      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
+          # user-facing error message should be localized and sent in the
+          # google.rpc.Status.details field, or localized by the client.
+      &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
+          # message types for APIs to use.
+        {
+          &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+        },
+      ],
+      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    },
     &quot;metadata&quot;: { # Service-specific metadata associated with the operation.  It typically
         # contains progress information and common metadata such as create time.
         # Some services might not provide such metadata.  Any method that returns a
         # long-running operation should document the metadata type, if any.
       &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
     },
+    &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
+        # originally returns it. If you use the default HTTP mapping, the
+        # `name` should be a resource name ending with `operations/{unique_id}`.
     &quot;response&quot;: { # The normal response of the operation in case of success.  If the original
         # method returns no data on success, such as `Delete`, the response is
         # `google.protobuf.Empty`.  If the original method is standard
@@ -280,24 +295,9 @@
         # `TakeSnapshotResponse`.
       &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
     },
-    &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
-        # different programming environments, including REST APIs and RPC APIs. It is
-        # used by [gRPC](https://github.com/grpc). Each `Status` message contains
-        # three pieces of data: error code, error message, and error details.
-        #
-        # You can find out more about this error model and how to work with it in the
-        # [API Design Guide](https://cloud.google.com/apis/design/errors).
-      &quot;details&quot;: [ # A list of messages that carry the error details.  There is a common set of
-          # message types for APIs to use.
-        {
-          &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
-        },
-      ],
-      &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
-          # user-facing error message should be localized and sent in the
-          # google.rpc.Status.details field, or localized by the client.
-      &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
-    },
+    &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress.
+        # If `true`, the operation is completed, and either `error` or `response` is
+        # available.
   }</pre>
 </div>
 
@@ -322,8 +322,7 @@
       #
       # A `Membership` defines a relationship between a `Group` and an entity
       # belonging to that `Group`, referred to as a &quot;member&quot;.
-    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
-    &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
+    &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
         #
         # Either `member_key` or `preferred_member_key` must be set when calling
         # MembershipsService.CreateMembership but not both; both shall be set
@@ -332,14 +331,6 @@
         # An entity can represent either a group with an optional `namespace` or a user
         # without a `namespace`. The combination of `id` and `namespace` must be
         # unique; however, the same `id` can be used with different `namespace`s.
-      &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-          #
-          # If not specified, the `EntityKey` represents a Google-managed entity such
-          # as a Google user or a Google Group.
-          #
-          # If specified, the `EntityKey` represents an external-identity-mapped group.
-          # The namespace must correspond to an identity source created in Admin
-          # Console and must be in the form of `identitysources/{identity_source_id}.
       &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
           #
           # For Google-managed entities, the `id` must be the email address of an
@@ -349,11 +340,44 @@
           # to the Identity Source&#x27;s requirements.
           #
           # Must be unique within a `namespace`.
+      &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+          #
+          # If not specified, the `EntityKey` represents a Google-managed entity such
+          # as a Google user or a Google Group.
+          #
+          # If specified, the `EntityKey` represents an external-identity-mapped group.
+          # The namespace must correspond to an identity source created in Admin
+          # Console and must be in the form of `identitysources/{identity_source_id}.
     },
-    &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-        # the `Membership`.
+    &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
         #
-        # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+        # Either `member_key` or `preferred_member_key` must be set when calling
+        # MembershipsService.CreateMembership but not both; both shall be set
+        # when returned.
+        #
+        # An entity can represent either a group with an optional `namespace` or a user
+        # without a `namespace`. The combination of `id` and `namespace` must be
+        # unique; however, the same `id` can be used with different `namespace`s.
+      &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+          #
+          # For Google-managed entities, the `id` must be the email address of an
+          # existing group or user.
+          #
+          # For external-identity-mapped entities, the `id` must be a string conforming
+          # to the Identity Source&#x27;s requirements.
+          #
+          # Must be unique within a `namespace`.
+      &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+          #
+          # If not specified, the `EntityKey` represents a Google-managed entity such
+          # as a Google user or a Google Group.
+          #
+          # If specified, the `EntityKey` represents an external-identity-mapped group.
+          # The namespace must correspond to an identity source created in Admin
+          # Console and must be in the form of `identitysources/{identity_source_id}.
+    },
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+    &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
     &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
         #
         # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -367,34 +391,10 @@
             # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
       },
     ],
-    &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+    &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+        # the `Membership`.
         #
-        # Either `member_key` or `preferred_member_key` must be set when calling
-        # MembershipsService.CreateMembership but not both; both shall be set
-        # when returned.
-        #
-        # An entity can represent either a group with an optional `namespace` or a user
-        # without a `namespace`. The combination of `id` and `namespace` must be
-        # unique; however, the same `id` can be used with different `namespace`s.
-      &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-          #
-          # If not specified, the `EntityKey` represents a Google-managed entity such
-          # as a Google user or a Google Group.
-          #
-          # If specified, the `EntityKey` represents an external-identity-mapped group.
-          # The namespace must correspond to an identity source created in Admin
-          # Console and must be in the form of `identitysources/{identity_source_id}.
-      &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-          #
-          # For Google-managed entities, the `id` must be the email address of an
-          # existing group or user.
-          #
-          # For external-identity-mapped entities, the `id` must be a string conforming
-          # to the Identity Source&#x27;s requirements.
-          #
-          # Must be unique within a `namespace`.
-    },
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+        # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
   }</pre>
 </div>
 
@@ -432,15 +432,12 @@
   An object of the form:
 
     { # The response message for MembershipsService.ListMemberships.
-    &quot;nextPageToken&quot;: &quot;A String&quot;, # A continuation token to retrieve the next page of results, or empty if
-        # there are no more results available.
     &quot;memberships&quot;: [ # The `Membership`s under the specified `parent`.
       { # A membership within the Cloud Identity Groups API.
           #
           # A `Membership` defines a relationship between a `Group` and an entity
           # belonging to that `Group`, referred to as a &quot;member&quot;.
-        &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
-        &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
+        &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
             #
             # Either `member_key` or `preferred_member_key` must be set when calling
             # MembershipsService.CreateMembership but not both; both shall be set
@@ -449,14 +446,6 @@
             # An entity can represent either a group with an optional `namespace` or a user
             # without a `namespace`. The combination of `id` and `namespace` must be
             # unique; however, the same `id` can be used with different `namespace`s.
-          &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-              #
-              # If not specified, the `EntityKey` represents a Google-managed entity such
-              # as a Google user or a Google Group.
-              #
-              # If specified, the `EntityKey` represents an external-identity-mapped group.
-              # The namespace must correspond to an identity source created in Admin
-              # Console and must be in the form of `identitysources/{identity_source_id}.
           &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
               #
               # For Google-managed entities, the `id` must be the email address of an
@@ -466,11 +455,44 @@
               # to the Identity Source&#x27;s requirements.
               #
               # Must be unique within a `namespace`.
+          &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+              #
+              # If not specified, the `EntityKey` represents a Google-managed entity such
+              # as a Google user or a Google Group.
+              #
+              # If specified, the `EntityKey` represents an external-identity-mapped group.
+              # The namespace must correspond to an identity source created in Admin
+              # Console and must be in the form of `identitysources/{identity_source_id}.
         },
-        &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-            # the `Membership`.
+        &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
             #
-            # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+            # Either `member_key` or `preferred_member_key` must be set when calling
+            # MembershipsService.CreateMembership but not both; both shall be set
+            # when returned.
+            #
+            # An entity can represent either a group with an optional `namespace` or a user
+            # without a `namespace`. The combination of `id` and `namespace` must be
+            # unique; however, the same `id` can be used with different `namespace`s.
+          &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+              #
+              # For Google-managed entities, the `id` must be the email address of an
+              # existing group or user.
+              #
+              # For external-identity-mapped entities, the `id` must be a string conforming
+              # to the Identity Source&#x27;s requirements.
+              #
+              # Must be unique within a `namespace`.
+          &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+              #
+              # If not specified, the `EntityKey` represents a Google-managed entity such
+              # as a Google user or a Google Group.
+              #
+              # If specified, the `EntityKey` represents an external-identity-mapped group.
+              # The namespace must correspond to an identity source created in Admin
+              # Console and must be in the form of `identitysources/{identity_source_id}.
+        },
+        &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+        &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
         &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
             #
             # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -484,36 +506,14 @@
                 # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
           },
         ],
-        &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+        &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+            # the `Membership`.
             #
-            # Either `member_key` or `preferred_member_key` must be set when calling
-            # MembershipsService.CreateMembership but not both; both shall be set
-            # when returned.
-            #
-            # An entity can represent either a group with an optional `namespace` or a user
-            # without a `namespace`. The combination of `id` and `namespace` must be
-            # unique; however, the same `id` can be used with different `namespace`s.
-          &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-              #
-              # If not specified, the `EntityKey` represents a Google-managed entity such
-              # as a Google user or a Google Group.
-              #
-              # If specified, the `EntityKey` represents an external-identity-mapped group.
-              # The namespace must correspond to an identity source created in Admin
-              # Console and must be in the form of `identitysources/{identity_source_id}.
-          &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-              #
-              # For Google-managed entities, the `id` must be the email address of an
-              # existing group or user.
-              #
-              # For external-identity-mapped entities, the `id` must be a string conforming
-              # to the Identity Source&#x27;s requirements.
-              #
-              # Must be unique within a `namespace`.
-        },
-        &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+            # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
       },
     ],
+    &quot;nextPageToken&quot;: &quot;A String&quot;, # A continuation token to retrieve the next page of results, or empty if
+        # there are no more results available.
   }</pre>
 </div>
 
@@ -532,7 +532,7 @@
 </div>
 
 <div class="method">
-    <code class="details" id="lookup">lookup(parent, memberKey_namespace=None, memberKey_id=None, x__xgafv=None)</code>
+    <code class="details" id="lookup">lookup(parent, memberKey_id=None, memberKey_namespace=None, x__xgafv=None)</code>
   <pre>Looks up the [resource
 name](https://cloud.google.com/apis/design/resource_names) of a
 `Membership` by its `EntityKey`.
@@ -541,14 +541,6 @@
   parent: string, Required. The parent `Group` resource under which to lookup the `Membership` name.
 
 Must be of the form `groups/{group_id}`. (required)
-  memberKey_namespace: string, The namespace in which the entity exists.
-
-If not specified, the `EntityKey` represents a Google-managed entity such
-as a Google user or a Google Group.
-
-If specified, the `EntityKey` represents an external-identity-mapped group.
-The namespace must correspond to an identity source created in Admin
-Console and must be in the form of `identitysources/{identity_source_id}.
   memberKey_id: string, The ID of the entity.
 
 For Google-managed entities, the `id` must be the email address of an
@@ -558,6 +550,14 @@
 to the Identity Source&#x27;s requirements.
 
 Must be unique within a `namespace`.
+  memberKey_namespace: string, The namespace in which the entity exists.
+
+If not specified, the `EntityKey` represents a Google-managed entity such
+as a Google user or a Google Group.
+
+If specified, the `EntityKey` represents an external-identity-mapped group.
+The namespace must correspond to an identity source created in Admin
+Console and must be in the form of `identitysources/{identity_source_id}.
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -587,6 +587,29 @@
     The object takes the form of:
 
 { # The request message for MembershipsService.ModifyMembershipRoles.
+    &quot;updateRolesParams&quot;: [ # The `MembershipRole`s to be updated.
+        # 
+        # Updating roles in the same request as adding or removing roles is not
+        # supported.
+        # 
+        # Must not be set if either `add_roles` or `remove_roles` is set.
+      { # The details of an update to a `MembershipRole`.
+        &quot;fieldMask&quot;: &quot;A String&quot;, # The fully-qualified names of fields to update.
+            #
+            # May only contain the field `expiry_detail`.
+        &quot;membershipRole&quot;: { # A membership role within the Cloud Identity Groups API. # The `MembershipRole`s to be updated.
+            #
+            # Only `MEMBER` `MembershipRoles` can currently be updated.
+            #
+            # May only contain a `MembershipRole` with `name` `MEMBER`.
+            #
+            # A `MembershipRole` defines the privileges granted to a `Membership`.
+          &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
+              #
+              # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+        },
+      },
+    ],
     &quot;removeRoles&quot;: [ # The `name`s of the `MembershipRole`s to be removed.
         # 
         # Adding or removing roles in the same request as updating roles is not
@@ -613,29 +636,6 @@
             # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
       },
     ],
-    &quot;updateRolesParams&quot;: [ # The `MembershipRole`s to be updated.
-        # 
-        # Updating roles in the same request as adding or removing roles is not
-        # supported.
-        # 
-        # Must not be set if either `add_roles` or `remove_roles` is set.
-      { # The details of an update to a `MembershipRole`.
-        &quot;fieldMask&quot;: &quot;A String&quot;, # The fully-qualified names of fields to update.
-            #
-            # May only contain the field `expiry_detail`.
-        &quot;membershipRole&quot;: { # A membership role within the Cloud Identity Groups API. # The `MembershipRole`s to be updated.
-            #
-            # Only `MEMBER` `MembershipRoles` can currently be updated.
-            #
-            # May only contain a `MembershipRole` with `name` `MEMBER`.
-            #
-            # A `MembershipRole` defines the privileges granted to a `Membership`.
-          &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`.
-              #
-              # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
-        },
-      },
-    ],
   }
 
   x__xgafv: string, V1 error format.
@@ -651,8 +651,7 @@
         #
         # A `Membership` defines a relationship between a `Group` and an entity
         # belonging to that `Group`, referred to as a &quot;member&quot;.
-      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
-      &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
+      &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
           #
           # Either `member_key` or `preferred_member_key` must be set when calling
           # MembershipsService.CreateMembership but not both; both shall be set
@@ -661,14 +660,6 @@
           # An entity can represent either a group with an optional `namespace` or a user
           # without a `namespace`. The combination of `id` and `namespace` must be
           # unique; however, the same `id` can be used with different `namespace`s.
-        &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-            #
-            # If not specified, the `EntityKey` represents a Google-managed entity such
-            # as a Google user or a Google Group.
-            #
-            # If specified, the `EntityKey` represents an external-identity-mapped group.
-            # The namespace must correspond to an identity source created in Admin
-            # Console and must be in the form of `identitysources/{identity_source_id}.
         &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
             #
             # For Google-managed entities, the `id` must be the email address of an
@@ -678,11 +669,44 @@
             # to the Identity Source&#x27;s requirements.
             #
             # Must be unique within a `namespace`.
+        &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+            #
+            # If not specified, the `EntityKey` represents a Google-managed entity such
+            # as a Google user or a Google Group.
+            #
+            # If specified, the `EntityKey` represents an external-identity-mapped group.
+            # The namespace must correspond to an identity source created in Admin
+            # Console and must be in the form of `identitysources/{identity_source_id}.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
-          # the `Membership`.
+      &quot;preferredMemberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Required. Immutable. The `EntityKey` of the member.
           #
-          # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
+          # Either `member_key` or `preferred_member_key` must be set when calling
+          # MembershipsService.CreateMembership but not both; both shall be set
+          # when returned.
+          #
+          # An entity can represent either a group with an optional `namespace` or a user
+          # without a `namespace`. The combination of `id` and `namespace` must be
+          # unique; however, the same `id` can be used with different `namespace`s.
+        &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
+            #
+            # For Google-managed entities, the `id` must be the email address of an
+            # existing group or user.
+            #
+            # For external-identity-mapped entities, the `id` must be a string conforming
+            # to the Identity Source&#x27;s requirements.
+            #
+            # Must be unique within a `namespace`.
+        &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
+            #
+            # If not specified, the `EntityKey` represents a Google-managed entity such
+            # as a Google user or a Google Group.
+            #
+            # If specified, the `EntityKey` represents an external-identity-mapped group.
+            # The namespace must correspond to an identity source created in Admin
+            # Console and must be in the form of `identitysources/{identity_source_id}.
+      },
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was last updated.
       &quot;roles&quot;: [ # The `MembershipRole`s that apply to the `Membership`.
           #
           # If unspecified, defaults to a single `MembershipRole` with `name` `MEMBER`.
@@ -696,34 +720,10 @@
               # Must be one of `OWNER`, `MANAGER`, `MEMBER`.
         },
       ],
-      &quot;memberKey&quot;: { # A unique identifier for an entity in the Cloud Identity Groups API. # Immutable. The `EntityKey` of the member.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The [resource name](https://cloud.google.com/apis/design/resource_names) of
+          # the `Membership`.
           #
-          # Either `member_key` or `preferred_member_key` must be set when calling
-          # MembershipsService.CreateMembership but not both; both shall be set
-          # when returned.
-          #
-          # An entity can represent either a group with an optional `namespace` or a user
-          # without a `namespace`. The combination of `id` and `namespace` must be
-          # unique; however, the same `id` can be used with different `namespace`s.
-        &quot;namespace&quot;: &quot;A String&quot;, # The namespace in which the entity exists.
-            #
-            # If not specified, the `EntityKey` represents a Google-managed entity such
-            # as a Google user or a Google Group.
-            #
-            # If specified, the `EntityKey` represents an external-identity-mapped group.
-            # The namespace must correspond to an identity source created in Admin
-            # Console and must be in the form of `identitysources/{identity_source_id}.
-        &quot;id&quot;: &quot;A String&quot;, # The ID of the entity.
-            #
-            # For Google-managed entities, the `id` must be the email address of an
-            # existing group or user.
-            #
-            # For external-identity-mapped entities, the `id` must be a string conforming
-            # to the Identity Source&#x27;s requirements.
-            #
-            # Must be unique within a `namespace`.
-      },
-      &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time when the `Membership` was created.
+          # Shall be of the form `groups/{group_id}/memberships/{membership_id}`.
     },
   }</pre>
 </div>