docs: update docs (#916)

* fix: re-run script

* test: fix noxfile
diff --git a/docs/dyn/iap_v1.v1.html b/docs/dyn/iap_v1.v1.html
index d3385f9..c1e5aca 100644
--- a/docs/dyn/iap_v1.v1.html
+++ b/docs/dyn/iap_v1.v1.html
@@ -236,60 +236,6 @@
         # `condition` that determines how and when the `bindings` are applied. Each
         # of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
-        "role": "A String", # Role that is assigned to `members`.
-            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
-        "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
-            #
-            # If the condition evaluates to `true`, then this binding applies to the
-            # current request.
-            #
-            # If the condition evaluates to `false`, then this binding does not apply to
-            # the current request. However, a different role binding might grant the same
-            # role to one or more of the members in this binding.
-            #
-            # To learn which resources support conditions in their IAM policies, see the
-            # [IAM
-            # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
-            # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
-            # are documented at https://github.com/google/cel-spec.
-            #
-            # Example (Comparison):
-            #
-            #     title: "Summary size limit"
-            #     description: "Determines if a summary is less than 100 chars"
-            #     expression: "document.summary.size() < 100"
-            #
-            # Example (Equality):
-            #
-            #     title: "Requestor is owner"
-            #     description: "Determines if requestor is the document owner"
-            #     expression: "document.owner == request.auth.claims.email"
-            #
-            # Example (Logic):
-            #
-            #     title: "Public documents"
-            #     description: "Determine whether the document should be publicly visible"
-            #     expression: "document.type != 'private' && document.type != 'internal'"
-            #
-            # Example (Data Manipulation):
-            #
-            #     title: "Notification string"
-            #     description: "Create a notification string with a timestamp."
-            #     expression: "'New message received at ' + string(document.create_time)"
-            #
-            # The exact variables and functions that may be referenced within an expression
-            # are determined by the service that evaluates it. See the service
-            # documentation for additional information.
-          "expression": "A String", # Textual representation of an expression in Common Expression Language
-              # syntax.
-          "title": "A String", # Optional. Title for the expression, i.e. a short string describing
-              # its purpose. This can be used e.g. in UIs which allow to enter the
-              # expression.
-          "location": "A String", # Optional. String indicating the location of the expression for error
-              # reporting, e.g. a file name and a position in the file.
-          "description": "A String", # Optional. Description of the expression. This is a longer text which
-              # describes the expression, e.g. when hovered over it in a UI.
-        },
         "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
             # `members` can have the following values:
             #
@@ -335,6 +281,60 @@
             #
           "A String",
         ],
+        "role": "A String", # Role that is assigned to `members`.
+            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+        "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
+            #
+            # If the condition evaluates to `true`, then this binding applies to the
+            # current request.
+            #
+            # If the condition evaluates to `false`, then this binding does not apply to
+            # the current request. However, a different role binding might grant the same
+            # role to one or more of the members in this binding.
+            #
+            # To learn which resources support conditions in their IAM policies, see the
+            # [IAM
+            # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+            # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+            # are documented at https://github.com/google/cel-spec.
+            #
+            # Example (Comparison):
+            #
+            #     title: "Summary size limit"
+            #     description: "Determines if a summary is less than 100 chars"
+            #     expression: "document.summary.size() < 100"
+            #
+            # Example (Equality):
+            #
+            #     title: "Requestor is owner"
+            #     description: "Determines if requestor is the document owner"
+            #     expression: "document.owner == request.auth.claims.email"
+            #
+            # Example (Logic):
+            #
+            #     title: "Public documents"
+            #     description: "Determine whether the document should be publicly visible"
+            #     expression: "document.type != 'private' && document.type != 'internal'"
+            #
+            # Example (Data Manipulation):
+            #
+            #     title: "Notification string"
+            #     description: "Create a notification string with a timestamp."
+            #     expression: "'New message received at ' + string(document.create_time)"
+            #
+            # The exact variables and functions that may be referenced within an expression
+            # are determined by the service that evaluates it. See the service
+            # documentation for additional information.
+          "description": "A String", # Optional. Description of the expression. This is a longer text which
+              # describes the expression, e.g. when hovered over it in a UI.
+          "expression": "A String", # Textual representation of an expression in Common Expression Language
+              # syntax.
+          "title": "A String", # Optional. Title for the expression, i.e. a short string describing
+              # its purpose. This can be used e.g. in UIs which allow to enter the
+              # expression.
+          "location": "A String", # Optional. String indicating the location of the expression for error
+              # reporting, e.g. a file name and a position in the file.
+        },
       },
     ],
   }</pre>
@@ -357,24 +357,22 @@
   An object of the form:
 
     { # The IAP configurable settings.
-      &quot;applicationSettings&quot;: { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP
-        &quot;csmSettings&quot;: { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP&#x27;s behavior for a CSM mesh.
-            # RCTokens are IAP generated JWTs that can be verified at the application. The
-            # RCToken is primarily used for ISTIO deployments, and can be scoped to a
-            # single mesh by configuring the audience field accordingly
-          &quot;rctokenAud&quot;: &quot;A String&quot;, # Audience claim set in the generated RCToken. This value is not validated by
-              # IAP.
-        },
-        &quot;cookieDomain&quot;: &quot;A String&quot;, # The Domain value to set for cookies generated by IAP. This value is not
-            # validated by the API, but will be ignored at runtime if invalid.
-        &quot;accessDeniedPageSettings&quot;: { # Custom content configuration for access denied page. # Customization for Access Denied page.
-            # IAP allows customers to define a custom URI to use as the error page when
-            # access is denied to users. If IAP prevents access to this page, the default
-            # IAP error page will be displayed instead.
-          &quot;accessDeniedPageUri&quot;: &quot;A String&quot;, # The URI to be redirected to when access is denied.
-        },
-      },
       &quot;accessSettings&quot;: { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP
+        &quot;oauthSettings&quot;: { # Configuration for OAuth login&amp;consent flow behavior as well as for OAuth # Settings to configure IAP&#x27;s OAuth behavior.
+            # Credentials.
+          &quot;clientId&quot;: &quot;A String&quot;, # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If
+              # this field is set, you can skip obtaining the OAuth credentials in this
+              # step:
+              # https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.
+              # However, this could allow for client sharing. The risks of client sharing
+              # are outlined here:
+              # https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.
+          &quot;loginHint&quot;: &quot;A String&quot;, # Domain hint to send as hd=? parameter in OAuth request flow. Enables
+              # redirect to primary IDP by skipping Google&#x27;s login screen.
+              # https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
+              # Note: IAP does not verify that the id token&#x27;s hd claim matches this value
+              # since access behavior is managed by IAM policies.
+        },
         &quot;corsSettings&quot;: { # Allows customers to configure HTTP request paths that&#x27;ll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.
             # call to bypass authentication and authorization.
           &quot;allowHttpOptions&quot;: True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If
@@ -399,12 +397,6 @@
             # permission check to happen against the linked customer project.
             # This is only ever supposed to be used by google internal teams, hence the
             # restriction on the proto.
-          &quot;iamServiceName&quot;: &quot;A String&quot;, # The DNS name of the service (e.g. &quot;resourcemanager.googleapis.com&quot;).
-              # This should be the domain name part of the full resource names (see
-              # https://aip.dev/122#full-resource-names), which is usually
-              # the same as IamServiceSpec.service of the service where the resource type
-              # is defined.
-          &quot;iamPermission&quot;: &quot;A String&quot;, # Permission to check in IAM.
           &quot;policyName&quot;: { # Policy name to be checked
             &quot;type&quot;: &quot;A String&quot;, # Valid values for type might be &#x27;gce&#x27;, &#x27;gcs&#x27;, &#x27;project&#x27;, &#x27;account&#x27; etc.
             &quot;id&quot;: &quot;A String&quot;,
@@ -418,13 +410,6 @@
                 # This field should be set to &quot;local&quot;.
           },
           &quot;resource&quot;: { # IAM resource to check permission on
-            &quot;type&quot;: &quot;A String&quot;, # The public resource type name of the resource on which conditions will be
-                # evaluated. It is configured using the official_name of the ResourceType as
-                # defined in service configurations under //configs/cloud/resourcetypes.
-                # For example, the official_name for GCP projects is set as
-                # &#x27;cloudresourcemanager.googleapis.com/Project&#x27; according to
-                # //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
-                # For details see go/iam-conditions-integration-guide.
             &quot;labels&quot;: { # The service defined labels of the resource on which the conditions will be
                 # evaluated. The semantics - including the key names - are vague to IAM.
                 # If the effective condition has a reference to a `resource.labels[foo]`
@@ -456,25 +441,40 @@
                 # names. For a `list` permission check, the resource.name value must be set
                 # to the parent resource. If the parent resource is a project, this field
                 # should be left unset.
+            &quot;type&quot;: &quot;A String&quot;, # The public resource type name of the resource on which conditions will be
+                # evaluated. It is configured using the official_name of the ResourceType as
+                # defined in service configurations under //configs/cloud/resourcetypes.
+                # For example, the official_name for GCP projects is set as
+                # &#x27;cloudresourcemanager.googleapis.com/Project&#x27; according to
+                # //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
+                # For details see go/iam-conditions-integration-guide.
           },
-        },
-        &quot;oauthSettings&quot;: { # Configuration for OAuth login&amp;consent flow behavior as well as for OAuth # Settings to configure IAP&#x27;s OAuth behavior.
-            # Credentials.
-          &quot;clientId&quot;: &quot;A String&quot;, # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If
-              # this field is set, you can skip obtaining the OAuth credentials in this
-              # step:
-              # https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.
-              # However, this could allow for client sharing. The risks of client sharing
-              # are outlined here:
-              # https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.
-          &quot;loginHint&quot;: &quot;A String&quot;, # Domain hint to send as hd=? parameter in OAuth request flow. Enables
-              # redirect to primary IDP by skipping Google&#x27;s login screen.
-              # https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
-              # Note: IAP does not verify that the id token&#x27;s hd claim matches this value
-              # since access behavior is managed by IAM policies.
+          &quot;iamServiceName&quot;: &quot;A String&quot;, # The DNS name of the service (e.g. &quot;resourcemanager.googleapis.com&quot;).
+              # This should be the domain name part of the full resource names (see
+              # https://aip.dev/122#full-resource-names), which is usually
+              # the same as IamServiceSpec.service of the service where the resource type
+              # is defined.
+          &quot;iamPermission&quot;: &quot;A String&quot;, # Permission to check in IAM.
         },
       },
       &quot;name&quot;: &quot;A String&quot;, # Required. The resource name of the IAP protected resource.
+      &quot;applicationSettings&quot;: { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP
+        &quot;csmSettings&quot;: { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP&#x27;s behavior for a CSM mesh.
+            # RCTokens are IAP generated JWTs that can be verified at the application. The
+            # RCToken is primarily used for ISTIO deployments, and can be scoped to a
+            # single mesh by configuring the audience field accordingly
+          &quot;rctokenAud&quot;: &quot;A String&quot;, # Audience claim set in the generated RCToken. This value is not validated by
+              # IAP.
+        },
+        &quot;cookieDomain&quot;: &quot;A String&quot;, # The Domain value to set for cookies generated by IAP. This value is not
+            # validated by the API, but will be ignored at runtime if invalid.
+        &quot;accessDeniedPageSettings&quot;: { # Custom content configuration for access denied page. # Customization for Access Denied page.
+            # IAP allows customers to define a custom URI to use as the error page when
+            # access is denied to users. If IAP prevents access to this page, the default
+            # IAP error page will be displayed instead.
+          &quot;accessDeniedPageUri&quot;: &quot;A String&quot;, # The URI to be redirected to when access is denied.
+        },
+      },
     }</pre>
 </div>
 
@@ -602,60 +602,6 @@
           # `condition` that determines how and when the `bindings` are applied. Each
           # of the `bindings` must contain at least one member.
         { # Associates `members` with a `role`.
-          &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
-              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
-          &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
-              #
-              # If the condition evaluates to `true`, then this binding applies to the
-              # current request.
-              #
-              # If the condition evaluates to `false`, then this binding does not apply to
-              # the current request. However, a different role binding might grant the same
-              # role to one or more of the members in this binding.
-              #
-              # To learn which resources support conditions in their IAM policies, see the
-              # [IAM
-              # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
-              # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
-              # are documented at https://github.com/google/cel-spec.
-              #
-              # Example (Comparison):
-              #
-              #     title: &quot;Summary size limit&quot;
-              #     description: &quot;Determines if a summary is less than 100 chars&quot;
-              #     expression: &quot;document.summary.size() &lt; 100&quot;
-              #
-              # Example (Equality):
-              #
-              #     title: &quot;Requestor is owner&quot;
-              #     description: &quot;Determines if requestor is the document owner&quot;
-              #     expression: &quot;document.owner == request.auth.claims.email&quot;
-              #
-              # Example (Logic):
-              #
-              #     title: &quot;Public documents&quot;
-              #     description: &quot;Determine whether the document should be publicly visible&quot;
-              #     expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
-              #
-              # Example (Data Manipulation):
-              #
-              #     title: &quot;Notification string&quot;
-              #     description: &quot;Create a notification string with a timestamp.&quot;
-              #     expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
-              #
-              # The exact variables and functions that may be referenced within an expression
-              # are determined by the service that evaluates it. See the service
-              # documentation for additional information.
-            &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
-                # syntax.
-            &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
-                # its purpose. This can be used e.g. in UIs which allow to enter the
-                # expression.
-            &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
-                # reporting, e.g. a file name and a position in the file.
-            &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
-                # describes the expression, e.g. when hovered over it in a UI.
-          },
           &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
               # `members` can have the following values:
               #
@@ -701,6 +647,60 @@
               #
             &quot;A String&quot;,
           ],
+          &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
+              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+          &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
+              #
+              # If the condition evaluates to `true`, then this binding applies to the
+              # current request.
+              #
+              # If the condition evaluates to `false`, then this binding does not apply to
+              # the current request. However, a different role binding might grant the same
+              # role to one or more of the members in this binding.
+              #
+              # To learn which resources support conditions in their IAM policies, see the
+              # [IAM
+              # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+              # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+              # are documented at https://github.com/google/cel-spec.
+              #
+              # Example (Comparison):
+              #
+              #     title: &quot;Summary size limit&quot;
+              #     description: &quot;Determines if a summary is less than 100 chars&quot;
+              #     expression: &quot;document.summary.size() &lt; 100&quot;
+              #
+              # Example (Equality):
+              #
+              #     title: &quot;Requestor is owner&quot;
+              #     description: &quot;Determines if requestor is the document owner&quot;
+              #     expression: &quot;document.owner == request.auth.claims.email&quot;
+              #
+              # Example (Logic):
+              #
+              #     title: &quot;Public documents&quot;
+              #     description: &quot;Determine whether the document should be publicly visible&quot;
+              #     expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
+              #
+              # Example (Data Manipulation):
+              #
+              #     title: &quot;Notification string&quot;
+              #     description: &quot;Create a notification string with a timestamp.&quot;
+              #     expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
+              #
+              # The exact variables and functions that may be referenced within an expression
+              # are determined by the service that evaluates it. See the service
+              # documentation for additional information.
+            &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
+                # describes the expression, e.g. when hovered over it in a UI.
+            &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
+                # syntax.
+            &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
+                # its purpose. This can be used e.g. in UIs which allow to enter the
+                # expression.
+            &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
+                # reporting, e.g. a file name and a position in the file.
+          },
         },
       ],
     },
@@ -821,60 +821,6 @@
         # `condition` that determines how and when the `bindings` are applied. Each
         # of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
-        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
-            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
-        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
-            #
-            # If the condition evaluates to `true`, then this binding applies to the
-            # current request.
-            #
-            # If the condition evaluates to `false`, then this binding does not apply to
-            # the current request. However, a different role binding might grant the same
-            # role to one or more of the members in this binding.
-            #
-            # To learn which resources support conditions in their IAM policies, see the
-            # [IAM
-            # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
-            # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
-            # are documented at https://github.com/google/cel-spec.
-            #
-            # Example (Comparison):
-            #
-            #     title: &quot;Summary size limit&quot;
-            #     description: &quot;Determines if a summary is less than 100 chars&quot;
-            #     expression: &quot;document.summary.size() &lt; 100&quot;
-            #
-            # Example (Equality):
-            #
-            #     title: &quot;Requestor is owner&quot;
-            #     description: &quot;Determines if requestor is the document owner&quot;
-            #     expression: &quot;document.owner == request.auth.claims.email&quot;
-            #
-            # Example (Logic):
-            #
-            #     title: &quot;Public documents&quot;
-            #     description: &quot;Determine whether the document should be publicly visible&quot;
-            #     expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
-            #
-            # Example (Data Manipulation):
-            #
-            #     title: &quot;Notification string&quot;
-            #     description: &quot;Create a notification string with a timestamp.&quot;
-            #     expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
-            #
-            # The exact variables and functions that may be referenced within an expression
-            # are determined by the service that evaluates it. See the service
-            # documentation for additional information.
-          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
-              # syntax.
-          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
-              # its purpose. This can be used e.g. in UIs which allow to enter the
-              # expression.
-          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
-              # reporting, e.g. a file name and a position in the file.
-          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
-              # describes the expression, e.g. when hovered over it in a UI.
-        },
         &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
             # `members` can have the following values:
             #
@@ -920,6 +866,60 @@
             #
           &quot;A String&quot;,
         ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
+            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
+            #
+            # If the condition evaluates to `true`, then this binding applies to the
+            # current request.
+            #
+            # If the condition evaluates to `false`, then this binding does not apply to
+            # the current request. However, a different role binding might grant the same
+            # role to one or more of the members in this binding.
+            #
+            # To learn which resources support conditions in their IAM policies, see the
+            # [IAM
+            # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+            # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+            # are documented at https://github.com/google/cel-spec.
+            #
+            # Example (Comparison):
+            #
+            #     title: &quot;Summary size limit&quot;
+            #     description: &quot;Determines if a summary is less than 100 chars&quot;
+            #     expression: &quot;document.summary.size() &lt; 100&quot;
+            #
+            # Example (Equality):
+            #
+            #     title: &quot;Requestor is owner&quot;
+            #     description: &quot;Determines if requestor is the document owner&quot;
+            #     expression: &quot;document.owner == request.auth.claims.email&quot;
+            #
+            # Example (Logic):
+            #
+            #     title: &quot;Public documents&quot;
+            #     description: &quot;Determine whether the document should be publicly visible&quot;
+            #     expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
+            #
+            # Example (Data Manipulation):
+            #
+            #     title: &quot;Notification string&quot;
+            #     description: &quot;Create a notification string with a timestamp.&quot;
+            #     expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
+            #
+            # The exact variables and functions that may be referenced within an expression
+            # are determined by the service that evaluates it. See the service
+            # documentation for additional information.
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
+              # describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
+              # syntax.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
+              # its purpose. This can be used e.g. in UIs which allow to enter the
+              # expression.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
+              # reporting, e.g. a file name and a position in the file.
+        },
       },
     ],
   }</pre>
@@ -974,24 +974,22 @@
     The object takes the form of:
 
 { # The IAP configurable settings.
-    &quot;applicationSettings&quot;: { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP
-      &quot;csmSettings&quot;: { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP&#x27;s behavior for a CSM mesh.
-          # RCTokens are IAP generated JWTs that can be verified at the application. The
-          # RCToken is primarily used for ISTIO deployments, and can be scoped to a
-          # single mesh by configuring the audience field accordingly
-        &quot;rctokenAud&quot;: &quot;A String&quot;, # Audience claim set in the generated RCToken. This value is not validated by
-            # IAP.
-      },
-      &quot;cookieDomain&quot;: &quot;A String&quot;, # The Domain value to set for cookies generated by IAP. This value is not
-          # validated by the API, but will be ignored at runtime if invalid.
-      &quot;accessDeniedPageSettings&quot;: { # Custom content configuration for access denied page. # Customization for Access Denied page.
-          # IAP allows customers to define a custom URI to use as the error page when
-          # access is denied to users. If IAP prevents access to this page, the default
-          # IAP error page will be displayed instead.
-        &quot;accessDeniedPageUri&quot;: &quot;A String&quot;, # The URI to be redirected to when access is denied.
-      },
-    },
     &quot;accessSettings&quot;: { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP
+      &quot;oauthSettings&quot;: { # Configuration for OAuth login&amp;consent flow behavior as well as for OAuth # Settings to configure IAP&#x27;s OAuth behavior.
+          # Credentials.
+        &quot;clientId&quot;: &quot;A String&quot;, # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If
+            # this field is set, you can skip obtaining the OAuth credentials in this
+            # step:
+            # https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.
+            # However, this could allow for client sharing. The risks of client sharing
+            # are outlined here:
+            # https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.
+        &quot;loginHint&quot;: &quot;A String&quot;, # Domain hint to send as hd=? parameter in OAuth request flow. Enables
+            # redirect to primary IDP by skipping Google&#x27;s login screen.
+            # https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
+            # Note: IAP does not verify that the id token&#x27;s hd claim matches this value
+            # since access behavior is managed by IAM policies.
+      },
       &quot;corsSettings&quot;: { # Allows customers to configure HTTP request paths that&#x27;ll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.
           # call to bypass authentication and authorization.
         &quot;allowHttpOptions&quot;: True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If
@@ -1016,12 +1014,6 @@
           # permission check to happen against the linked customer project.
           # This is only ever supposed to be used by google internal teams, hence the
           # restriction on the proto.
-        &quot;iamServiceName&quot;: &quot;A String&quot;, # The DNS name of the service (e.g. &quot;resourcemanager.googleapis.com&quot;).
-            # This should be the domain name part of the full resource names (see
-            # https://aip.dev/122#full-resource-names), which is usually
-            # the same as IamServiceSpec.service of the service where the resource type
-            # is defined.
-        &quot;iamPermission&quot;: &quot;A String&quot;, # Permission to check in IAM.
         &quot;policyName&quot;: { # Policy name to be checked
           &quot;type&quot;: &quot;A String&quot;, # Valid values for type might be &#x27;gce&#x27;, &#x27;gcs&#x27;, &#x27;project&#x27;, &#x27;account&#x27; etc.
           &quot;id&quot;: &quot;A String&quot;,
@@ -1035,13 +1027,6 @@
               # This field should be set to &quot;local&quot;.
         },
         &quot;resource&quot;: { # IAM resource to check permission on
-          &quot;type&quot;: &quot;A String&quot;, # The public resource type name of the resource on which conditions will be
-              # evaluated. It is configured using the official_name of the ResourceType as
-              # defined in service configurations under //configs/cloud/resourcetypes.
-              # For example, the official_name for GCP projects is set as
-              # &#x27;cloudresourcemanager.googleapis.com/Project&#x27; according to
-              # //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
-              # For details see go/iam-conditions-integration-guide.
           &quot;labels&quot;: { # The service defined labels of the resource on which the conditions will be
               # evaluated. The semantics - including the key names - are vague to IAM.
               # If the effective condition has a reference to a `resource.labels[foo]`
@@ -1073,25 +1058,40 @@
               # names. For a `list` permission check, the resource.name value must be set
               # to the parent resource. If the parent resource is a project, this field
               # should be left unset.
+          &quot;type&quot;: &quot;A String&quot;, # The public resource type name of the resource on which conditions will be
+              # evaluated. It is configured using the official_name of the ResourceType as
+              # defined in service configurations under //configs/cloud/resourcetypes.
+              # For example, the official_name for GCP projects is set as
+              # &#x27;cloudresourcemanager.googleapis.com/Project&#x27; according to
+              # //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
+              # For details see go/iam-conditions-integration-guide.
         },
-      },
-      &quot;oauthSettings&quot;: { # Configuration for OAuth login&amp;consent flow behavior as well as for OAuth # Settings to configure IAP&#x27;s OAuth behavior.
-          # Credentials.
-        &quot;clientId&quot;: &quot;A String&quot;, # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If
-            # this field is set, you can skip obtaining the OAuth credentials in this
-            # step:
-            # https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.
-            # However, this could allow for client sharing. The risks of client sharing
-            # are outlined here:
-            # https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.
-        &quot;loginHint&quot;: &quot;A String&quot;, # Domain hint to send as hd=? parameter in OAuth request flow. Enables
-            # redirect to primary IDP by skipping Google&#x27;s login screen.
-            # https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
-            # Note: IAP does not verify that the id token&#x27;s hd claim matches this value
-            # since access behavior is managed by IAM policies.
+        &quot;iamServiceName&quot;: &quot;A String&quot;, # The DNS name of the service (e.g. &quot;resourcemanager.googleapis.com&quot;).
+            # This should be the domain name part of the full resource names (see
+            # https://aip.dev/122#full-resource-names), which is usually
+            # the same as IamServiceSpec.service of the service where the resource type
+            # is defined.
+        &quot;iamPermission&quot;: &quot;A String&quot;, # Permission to check in IAM.
       },
     },
     &quot;name&quot;: &quot;A String&quot;, # Required. The resource name of the IAP protected resource.
+    &quot;applicationSettings&quot;: { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP
+      &quot;csmSettings&quot;: { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP&#x27;s behavior for a CSM mesh.
+          # RCTokens are IAP generated JWTs that can be verified at the application. The
+          # RCToken is primarily used for ISTIO deployments, and can be scoped to a
+          # single mesh by configuring the audience field accordingly
+        &quot;rctokenAud&quot;: &quot;A String&quot;, # Audience claim set in the generated RCToken. This value is not validated by
+            # IAP.
+      },
+      &quot;cookieDomain&quot;: &quot;A String&quot;, # The Domain value to set for cookies generated by IAP. This value is not
+          # validated by the API, but will be ignored at runtime if invalid.
+      &quot;accessDeniedPageSettings&quot;: { # Custom content configuration for access denied page. # Customization for Access Denied page.
+          # IAP allows customers to define a custom URI to use as the error page when
+          # access is denied to users. If IAP prevents access to this page, the default
+          # IAP error page will be displayed instead.
+        &quot;accessDeniedPageUri&quot;: &quot;A String&quot;, # The URI to be redirected to when access is denied.
+      },
+    },
   }
 
   updateMask: string, The field mask specifying which IAP settings should be updated.
@@ -1106,24 +1106,22 @@
   An object of the form:
 
     { # The IAP configurable settings.
-      &quot;applicationSettings&quot;: { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP
-        &quot;csmSettings&quot;: { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP&#x27;s behavior for a CSM mesh.
-            # RCTokens are IAP generated JWTs that can be verified at the application. The
-            # RCToken is primarily used for ISTIO deployments, and can be scoped to a
-            # single mesh by configuring the audience field accordingly
-          &quot;rctokenAud&quot;: &quot;A String&quot;, # Audience claim set in the generated RCToken. This value is not validated by
-              # IAP.
-        },
-        &quot;cookieDomain&quot;: &quot;A String&quot;, # The Domain value to set for cookies generated by IAP. This value is not
-            # validated by the API, but will be ignored at runtime if invalid.
-        &quot;accessDeniedPageSettings&quot;: { # Custom content configuration for access denied page. # Customization for Access Denied page.
-            # IAP allows customers to define a custom URI to use as the error page when
-            # access is denied to users. If IAP prevents access to this page, the default
-            # IAP error page will be displayed instead.
-          &quot;accessDeniedPageUri&quot;: &quot;A String&quot;, # The URI to be redirected to when access is denied.
-        },
-      },
       &quot;accessSettings&quot;: { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP
+        &quot;oauthSettings&quot;: { # Configuration for OAuth login&amp;consent flow behavior as well as for OAuth # Settings to configure IAP&#x27;s OAuth behavior.
+            # Credentials.
+          &quot;clientId&quot;: &quot;A String&quot;, # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If
+              # this field is set, you can skip obtaining the OAuth credentials in this
+              # step:
+              # https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.
+              # However, this could allow for client sharing. The risks of client sharing
+              # are outlined here:
+              # https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.
+          &quot;loginHint&quot;: &quot;A String&quot;, # Domain hint to send as hd=? parameter in OAuth request flow. Enables
+              # redirect to primary IDP by skipping Google&#x27;s login screen.
+              # https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
+              # Note: IAP does not verify that the id token&#x27;s hd claim matches this value
+              # since access behavior is managed by IAM policies.
+        },
         &quot;corsSettings&quot;: { # Allows customers to configure HTTP request paths that&#x27;ll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.
             # call to bypass authentication and authorization.
           &quot;allowHttpOptions&quot;: True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If
@@ -1148,12 +1146,6 @@
             # permission check to happen against the linked customer project.
             # This is only ever supposed to be used by google internal teams, hence the
             # restriction on the proto.
-          &quot;iamServiceName&quot;: &quot;A String&quot;, # The DNS name of the service (e.g. &quot;resourcemanager.googleapis.com&quot;).
-              # This should be the domain name part of the full resource names (see
-              # https://aip.dev/122#full-resource-names), which is usually
-              # the same as IamServiceSpec.service of the service where the resource type
-              # is defined.
-          &quot;iamPermission&quot;: &quot;A String&quot;, # Permission to check in IAM.
           &quot;policyName&quot;: { # Policy name to be checked
             &quot;type&quot;: &quot;A String&quot;, # Valid values for type might be &#x27;gce&#x27;, &#x27;gcs&#x27;, &#x27;project&#x27;, &#x27;account&#x27; etc.
             &quot;id&quot;: &quot;A String&quot;,
@@ -1167,13 +1159,6 @@
                 # This field should be set to &quot;local&quot;.
           },
           &quot;resource&quot;: { # IAM resource to check permission on
-            &quot;type&quot;: &quot;A String&quot;, # The public resource type name of the resource on which conditions will be
-                # evaluated. It is configured using the official_name of the ResourceType as
-                # defined in service configurations under //configs/cloud/resourcetypes.
-                # For example, the official_name for GCP projects is set as
-                # &#x27;cloudresourcemanager.googleapis.com/Project&#x27; according to
-                # //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
-                # For details see go/iam-conditions-integration-guide.
             &quot;labels&quot;: { # The service defined labels of the resource on which the conditions will be
                 # evaluated. The semantics - including the key names - are vague to IAM.
                 # If the effective condition has a reference to a `resource.labels[foo]`
@@ -1205,25 +1190,40 @@
                 # names. For a `list` permission check, the resource.name value must be set
                 # to the parent resource. If the parent resource is a project, this field
                 # should be left unset.
+            &quot;type&quot;: &quot;A String&quot;, # The public resource type name of the resource on which conditions will be
+                # evaluated. It is configured using the official_name of the ResourceType as
+                # defined in service configurations under //configs/cloud/resourcetypes.
+                # For example, the official_name for GCP projects is set as
+                # &#x27;cloudresourcemanager.googleapis.com/Project&#x27; according to
+                # //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
+                # For details see go/iam-conditions-integration-guide.
           },
-        },
-        &quot;oauthSettings&quot;: { # Configuration for OAuth login&amp;consent flow behavior as well as for OAuth # Settings to configure IAP&#x27;s OAuth behavior.
-            # Credentials.
-          &quot;clientId&quot;: &quot;A String&quot;, # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If
-              # this field is set, you can skip obtaining the OAuth credentials in this
-              # step:
-              # https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.
-              # However, this could allow for client sharing. The risks of client sharing
-              # are outlined here:
-              # https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.
-          &quot;loginHint&quot;: &quot;A String&quot;, # Domain hint to send as hd=? parameter in OAuth request flow. Enables
-              # redirect to primary IDP by skipping Google&#x27;s login screen.
-              # https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
-              # Note: IAP does not verify that the id token&#x27;s hd claim matches this value
-              # since access behavior is managed by IAM policies.
+          &quot;iamServiceName&quot;: &quot;A String&quot;, # The DNS name of the service (e.g. &quot;resourcemanager.googleapis.com&quot;).
+              # This should be the domain name part of the full resource names (see
+              # https://aip.dev/122#full-resource-names), which is usually
+              # the same as IamServiceSpec.service of the service where the resource type
+              # is defined.
+          &quot;iamPermission&quot;: &quot;A String&quot;, # Permission to check in IAM.
         },
       },
       &quot;name&quot;: &quot;A String&quot;, # Required. The resource name of the IAP protected resource.
+      &quot;applicationSettings&quot;: { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP
+        &quot;csmSettings&quot;: { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP&#x27;s behavior for a CSM mesh.
+            # RCTokens are IAP generated JWTs that can be verified at the application. The
+            # RCToken is primarily used for ISTIO deployments, and can be scoped to a
+            # single mesh by configuring the audience field accordingly
+          &quot;rctokenAud&quot;: &quot;A String&quot;, # Audience claim set in the generated RCToken. This value is not validated by
+              # IAP.
+        },
+        &quot;cookieDomain&quot;: &quot;A String&quot;, # The Domain value to set for cookies generated by IAP. This value is not
+            # validated by the API, but will be ignored at runtime if invalid.
+        &quot;accessDeniedPageSettings&quot;: { # Custom content configuration for access denied page. # Customization for Access Denied page.
+            # IAP allows customers to define a custom URI to use as the error page when
+            # access is denied to users. If IAP prevents access to this page, the default
+            # IAP error page will be displayed instead.
+          &quot;accessDeniedPageUri&quot;: &quot;A String&quot;, # The URI to be redirected to when access is denied.
+        },
+      },
     }</pre>
 </div>